git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Stack read out-of-bounds in parse_sha1_header_extended using git 2.10.0

From
Junio C Hamano <gitster@pobox.com>
Date
Sep 26, 2016, 18:06 UTC
Message-ID
<xmqqy42esfh2.fsf@gitster.mtv.corp.google.com>
In-Reply-To
<48506427.8357405.1474912907126.JavaMail.zimbra@imag.fr>
Gustavo Grieco <gustavo.grieco@imag.fr> writes:
> Fair enough. We are testing our tool to try to find
> bugs/vulnerabilities in several git implementations. I will report
> here my results if i can find some other memory issue in this git
> client.

Thanks. With or without security implications, it is basic codebase hygiene to identify and correct these issues, and your help is highly appreciated.

Previous: Gustavo GriecoNext: Junio C Hamano
Message 15 of 22 in “Stack read out-of-bounds in parse_sha1_header_extended using git 2.10.0”
  1. Gustavo GriecoSep 25, 2016
  2. Junio C HamanoSep 26, 2016
  3. unpack_sha1_header(): detect malformed object headerJunio C Hamano, Sep 26, 2016
  4. Jeff KingSep 26, 2016
  5. Junio C HamanoSep 26, 2016
  6. Junio C HamanoSep 26, 2016
  7. Jeff KingSep 26, 2016
  8. Junio C HamanoSep 26, 2016
  9. Junio C HamanoSep 26, 2016
  10. Jeff KingSep 26, 2016
  11. Jeff KingSep 26, 2016
  12. Gustavo GriecoSep 26, 2016
  13. Junio C HamanoSep 26, 2016
  14. Gustavo GriecoSep 26, 2016
  15. Junio C HamanoSep 26, 2016
  16. Junio C HamanoSep 26, 2016
  17. Gustavo GriecoSep 27, 2016
  18. Jeff KingSep 27, 2016
  19. Possible integer overflow parsing malformed objects in git 2.10.0Gustavo Grieco, Sep 27, 2016
  20. Jeff KingSep 27, 2016
  21. Junio C HamanoSep 27, 2016
  22. Gustavo GriecoSep 27, 2016

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.