)]}'
{
  "commit": "1fbb8d7ecb7bd78ac55d226b6b073372a5ea2c2d",
  "tree": "fbcd303384259bcd2a756f0ab73c030012029f59",
  "parents": [
    "e03d2a9ccb88c7ff42237f5890a05e071497f8ae"
  ],
  "author": {
    "name": "Patrick Steinhardt",
    "email": "ps@pks.im",
    "time": "Fri Jan 10 12:26:17 2025 +0100"
  },
  "committer": {
    "name": "Junio C Hamano",
    "email": "gitster@pobox.com",
    "time": "Fri Jan 10 06:56:54 2025 -0800"
  },
  "message": "builtin/blame: fix out-of-bounds read with excessive `--abbrev`\n\nIn 6411a0a896 (builtin/blame: fix type of `length` variable when\nemitting object ID, 2024-12-06) we have fixed the type of the `length`\nvariable. In order to avoid a cast from `size_t` to `int` in the call to\nprintf(3p) with the \"%.*s\" formatter we have converted the code to\ninstead use fwrite(3p), which accepts the length as a `size_t`.\n\nIt was reported though that this makes us read over the end of the OID\narray when the provided `--abbrev\u003d` length exceeds the length of the\nobject ID. This is because fwrite(3p) of course doesn\u0027t stop when it\nsees a NUL byte, whereas printf(3p) does.\n\nFix the bug by reverting back to printf(3p) and culling the provided\nlength to `GIT_MAX_HEXSZ` to keep it from overflowing when cast to an\n`int`.\n\nReported-by: Johannes Schindelin \u003cJohannes.Schindelin@gmx.de\u003e\nSigned-off-by: Patrick Steinhardt \u003cps@pks.im\u003e\nSigned-off-by: Junio C Hamano \u003cgitster@pobox.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "867032e4c16878ffd56df8a73162b89ca4bd2694",
      "old_mode": 33188,
      "old_path": "builtin/blame.c",
      "new_id": "d7630ac89cb7bd6e9ce5d72c6a98aa433b3b12da",
      "new_mode": 33188,
      "new_path": "builtin/blame.c"
    },
    {
      "type": "modify",
      "old_id": "0147de304b4d104cc7f05ea1f8d68f1a07ceb80d",
      "old_mode": 33261,
      "old_path": "t/t8002-blame.sh",
      "new_id": "b3f8b63d2e6744dd434f38fd9f10b56cd432141b",
      "new_mode": 33261,
      "new_path": "t/t8002-blame.sh"
    }
  ]
}