Re: [PATCH v2 09/25] upload-pack: tighten number parsing at "deepen" lines
- From
Junio C Hamano <gitster@pobox.com>
- Date
- Feb 4, 2016, 23:48 UTC
- Message-ID
- <xmqqvb64doln.fsf@gitster.mtv.corp.google.com>
- In-Reply-To
- <1454576641-29615-10-git-send-email-pclouds@gmail.com>
Nguyễn Thái Ngọc Duy <pclouds@gmail.com> writes:
> Signed-off-by: Nguyễn Thái Ngọc Duy <pclouds@gmail.com> > ---
Hmm, so "deepen 10-by-the-way-let-me-tell-you-something-else" was an acceptable input that some (third-party) version of "git fetch" could have used, but now we are rejecting it.
That "let me tell you something else" part wouldn't have reached outside this code, so it is inconceivable that anybody would relied on that looseness as a "feature", so the only practical risk would be if somebody wrote a protocol driver, mumbling "on the Internet, the end of line is CRLF, just like SMTP does", that sends a "deepen 10<CR><LF>". We used not to notice, but now we reject such a reimplementation of Git.
Show 19 quoted lines
> upload-pack.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/upload-pack.c b/upload-pack.c
> index 257ad48..9f14933 100644
> --- a/upload-pack.c
> +++ b/upload-pack.c
> @@ -641,9 +641,9 @@ static void receive_needs(void)
> continue;
> }
> if (skip_prefix(line, "deepen ", &arg)) {
> - char *end;
> + char *end = NULL;
> depth = strtol(arg, &end, 0);
> - if (end == arg || depth <= 0)
> + if (!end || *end || depth <= 0)
> die("Invalid deepen: %s", line);
> continue;
> }