)]}'
{
  "commit": "27ab4784d5c9e24345b9f5b443609cbe527c51f9",
  "tree": "a79a1b51547323fdcf5378096560f2c45960f023",
  "parents": [
    "f8587c31c96172aac547f83977c98fa8f0e2aa67"
  ],
  "author": {
    "name": "Patrick Steinhardt",
    "email": "ps@pks.im",
    "time": "Thu Dec 01 15:46:09 2022 +0100"
  },
  "committer": {
    "name": "Junio C Hamano",
    "email": "gitster@pobox.com",
    "time": "Fri Dec 09 17:07:04 2022 +0900"
  },
  "message": "fsck: implement checks for gitattributes\n\nRecently, a vulnerability was reported that can lead to an out-of-bounds\nwrite when reading an unreasonably large gitattributes file. The root\ncause of this error are multiple integer overflows in different parts of\nthe code when there are either too many lines, when paths are too long,\nwhen attribute names are too long, or when there are too many attributes\ndeclared for a pattern.\n\nAs all of these are related to size, it seems reasonable to restrict the\nsize of the gitattributes file via git-fsck(1). This allows us to both\nstop distributing known-vulnerable objects via common hosting platforms\nthat have fsck enabled, and users to protect themselves by enabling the\n`fetch.fsckObjects` config.\n\nThere are basically two checks:\n\n    1. We verify that size of the gitattributes file is smaller than\n       100MB.\n\n    2. We verify that the maximum line length does not exceed 2048\n       bytes.\n\nWith the preceding commits, both of these conditions would cause us to\neither ignore the complete gitattributes file or blob in the first case,\nor the specific line in the second case. Now with these consistency\nchecks added, we also grow the ability to stop distributing such files\nin the first place when `receive.fsckObjects` is enabled.\n\nSigned-off-by: Patrick Steinhardt \u003cps@pks.im\u003e\nSigned-off-by: Junio C Hamano \u003cgitster@pobox.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "3a7fb9ebbafb58001e2d7cc943006e0e8def2f67",
      "old_mode": 33188,
      "old_path": "fsck.c",
      "new_id": "614c7764294011ae941dc41aa3ae16d56af273ab",
      "new_mode": 33188,
      "new_path": "fsck.c"
    },
    {
      "type": "modify",
      "old_id": "d07f7a2459e8a264fe8cb2b6457d0ea729bb9e49",
      "old_mode": 33188,
      "old_path": "fsck.h",
      "new_id": "cc3379d4e93c315b99efad89b595467abbea0bfe",
      "new_mode": 33188,
      "new_path": "fsck.h"
    },
    {
      "type": "modify",
      "old_id": "5071ac63a5b51b89c973456211ce3aaac3587553",
      "old_mode": 33261,
      "old_path": "t/t1450-fsck.sh",
      "new_id": "9e0afe1fbf85f3438b956bb75a1e932f335606ed",
      "new_mode": 33261,
      "new_path": "t/t1450-fsck.sh"
    }
  ]
}