Re: [PATCH] dir.c: skip .gitignore, etc larger than INT_MAX

From: Junio C Hamano <gitster@pobox.com>
Date: May 31, 2024, 15:10 UTC
Message-ID: <xmqqbk4mhvah.fsf@gitster.g>
In-Reply-To: <20240531120034.GA442032@coredump.intra.peff.net>

Jeff King <peff@peff.net> writes:

> We use add_patterns() to read .gitignore, .git/info/exclude, etc, as
> well as other pattern-like files like sparse-checkout. The parser for
> these uses an "int" as an index, meaning that files over 2GB will
> generally cause signed integer overflow and out-of-bounds access.

I also wondered if we need similar protection on the attribute side, but it turns out that we process the files one line at a time without holding everything in core. Both exclude and attribute subsystem are not protected against parseed _result_ consuming too much memory, but at least with your patch, we are covered on the input side.

I wonder if it is worth rewriting the exclude side to stream like attribute parsing, though. It probalby is not.