git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH] attr.c: move ATTR_MAX_FILE_SIZE check into read_attr_from_buf()

From
Junio C Hamano <gitster@pobox.com>
Date
May 3, 2024, 19:45 UTC
Message-ID
<xmqqfruy65nh.fsf@gitster.g>
In-Reply-To
<28f6267709db78ba526d7ed9fc4a734674697c70.1714763555.git.me@ttaylorr.com>
Taylor Blau <me@ttaylorr.com> writes:
Show 16 quoted lines
> Ensure that we refuse to process a .gitattributes blob exceeding
> ATTR_MAX_FILE_SIZE when reading from either an arbitrary tree object or
> a sparse directory. This is done by pushing the ATTR_MAX_FILE_SIZE check
> down into the low-level `read_attr_from_buf()`.
>
> In doing so, plug a leak in `read_attr_from_index()` where we would
> accidentally leak the large buffer upon detecting it is too large to
> process.
>
> (Since `read_attr_from_buf()` handles a NULL buffer input, we can remove
> a NULL check before calling it in `read_attr_from_index()` as well).
>
> Co-authored-by: Jeff King <peff@peff.net>
> Signed-off-by: Jeff King <peff@peff.net>
> Signed-off-by: Taylor Blau <me@ttaylorr.com>
> ---
Makes sense.  Will queue.  Thanks.
Previous: Taylor BlauNext: Patrick Steinhardt
Message 2 of 3 in “attr.c: move ATTR_MAX_FILE_SIZE check into read_attr_from_buf()”
  1. attr.c: move ATTR_MAX_FILE_SIZE check into read_attr_from_buf()Taylor Blau, May 3, 2024
  2. Junio C HamanoMay 3, 2024
  3. Patrick SteinhardtMay 6, 2024

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.