# diff_tree_stdin 3 messages from 2005-10-12 to 2005-10-13. Participants: Morten Welinder, Junio C Hamano. Thread: https://gitlist.dev/t/2083 ## Morten Welinder, 2005-10-12 01:46 Subject: diff_tree_stdin Message-ID: <118833cc0510111846q42c5d7e5j162bdacd49dfebbc@mail.gmail.com> URL: https://gitlist.dev/e/118833cc0510111846q42c5d7e5j162bdacd49dfebbc%40mail.gmail.com ``` It looks like diff_tree_stdin can overrun the this_header buffer. Since the line length is already calculated, a check would be cheap. Morten ``` ## Junio C Hamano, 2005-10-13 07:11 Subject: Re: diff_tree_stdin Message-ID: <7vu0fl51tg.fsf@assigned-by-dhcp.cox.net> URL: https://gitlist.dev/e/7vu0fl51tg.fsf%40assigned-by-dhcp.cox.net In-Reply-To: <118833cc0510111846q42c5d7e5j162bdacd49dfebbc@mail.gmail.com> ``` Morten Welinder writes: > It looks like diff_tree_stdin can overrun the this_header buffer. Since the > line length is already calculated, a check would be cheap. I presume you are talking about "line", not this_header[], since you are talking about something whose length is already calculated. The output buffer this_header[] only ever gets two 40-byte SHA1 and a handful more, so probably 128 bytes would be big enough -- the current 1000 is overkill. The input line[] is first NUL terminated before getting scanned, and scanning with get_sha1_hex() stops immediately when we see NUL, and premature NUL makes it fail, so the first get_sha1_hex() would not overrun. If the first SHA1 is followed by garbage then the second get_sha1_hex() would not succeed without overrunning either. If line[40] is NUL then we do not even do the second get_sha1_hex() --- in any case I do not see overrun. I am getting tired (it _was_ my GIT day, but unfortunately I had to be worried about another day-job project during the day X-<), and I might probably be overlooking something fairly obvious to you. Care to explain? ``` ## Morten Welinder, 2005-10-13 15:01 Subject: Re: diff_tree_stdin Message-ID: <118833cc0510130801w2e900d9cr79c9666d536ef5b7@mail.gmail.com> URL: https://gitlist.dev/e/118833cc0510130801w2e900d9cr79c9666d536ef5b7%40mail.gmail.com In-Reply-To: <7vu0fl51tg.fsf@assigned-by-dhcp.cox.net> ``` > I presume you are talking about "line", not this_header[], since > you are talking about something whose length is already > calculated. I was talking about this_header. It gets slightly more than the length of "line" which is whatever came in from stdin, subject to a 1000 char limit. Morten ```