From 7ce4c8f752bc0da682acbda6457d6543ad5d0069 Mon Sep 17 00:00:00 2001 From: Jeff King Date: Fri, 14 Apr 2023 17:25:20 -0400 Subject: v0 protocol: use size_t for capability length/offset When parsing server capabilities, we use "int" to store lengths and offsets. At first glance this seems like a spot where our parser may be confused by integer overflow if somebody sent us a malicious response. In practice these strings are all bounded by the 64k limit of a pkt-line, so using "int" is OK. However, it makes the code simpler to audit if they just use size_t everywhere. Note that because we take these parameters as pointers, this also forces many callers to update their declared types. Signed-off-by: Jeff King Signed-off-by: Junio C Hamano --- transport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'transport.c') diff --git a/transport.c b/transport.c index 89a220425e..6223dc3de2 100644 --- a/transport.c +++ b/transport.c @@ -317,7 +317,7 @@ static struct ref *handshake(struct transport *transport, int for_push, struct git_transport_data *data = transport->data; struct ref *refs = NULL; struct packet_reader reader; - int sid_len; + size_t sid_len; const char *server_sid; connect_setup(transport, for_push); -- cgit v1.2.3