)]}'
{
  "commit": "3c50032ff5289cc45659f21949c8d09e52164579",
  "tree": "2d9a9379e7d94be5d8ad773466c90a76b79034d5",
  "parents": [
    "dfa6b32b5e599d97448337ed4fc18dd50c90758f"
  ],
  "author": {
    "name": "Patrick Steinhardt",
    "email": "ps@pks.im",
    "time": "Thu Dec 01 15:45:53 2022 +0100"
  },
  "committer": {
    "name": "Junio C Hamano",
    "email": "gitster@pobox.com",
    "time": "Mon Dec 05 15:50:03 2022 +0900"
  },
  "message": "attr: ignore overly large gitattributes files\n\nSimilar as with the preceding commit, start ignoring gitattributes files\nthat are overly large to protect us against out-of-bounds reads and\nwrites caused by integer overflows. Unfortunately, we cannot just define\n\"overly large\" in terms of any preexisting limits in the codebase.\n\nInstead, we choose a very conservative limit of 100MB. This is plenty of\nroom for specifying gitattributes, and incidentally it is also the limit\nfor blob sizes for GitHub. While we don\u0027t want GitHub to dictate limits\nhere, it is still sensible to use this fact for an informed decision\ngiven that it is hosting a huge set of repositories. Furthermore, over\nat GitLab we scanned a subset of repositories for their root-level\nattribute files. We found that 80% of them have a gitattributes file\nsmaller than 100kB, 99.99% have one smaller than 1MB, and only a single\nrepository had one that was almost 3MB in size. So enforcing a limit of\n100MB seems to give us ample of headroom.\n\nWith this limit in place we can be reasonably sure that there is no easy\nway to exploit the gitattributes file via integer overflows anymore.\nFurthermore, it protects us against resource exhaustion caused by\nallocating the in-memory data structures required to represent the\nparsed attributes.\n\nSigned-off-by: Patrick Steinhardt \u003cps@pks.im\u003e\nSigned-off-by: Junio C Hamano \u003cgitster@pobox.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "38ecd2fff30d33a86ec11f16f454a0a504a15fa2",
      "old_mode": 33188,
      "old_path": "attr.c",
      "new_id": "f9316d14baf835ee498722a4dc26bd9bd56a8efd",
      "new_mode": 33188,
      "new_path": "attr.c"
    },
    {
      "type": "modify",
      "old_id": "df9a75da550eb7f0fcd627dfee2e7e5ed098ae70",
      "old_mode": 33188,
      "old_path": "attr.h",
      "new_id": "5970f930fd0a44b4784964d0c7d1d3e882b84878",
      "new_mode": 33188,
      "new_path": "attr.h"
    },
    {
      "type": "modify",
      "old_id": "7d68e6a56e964dda5f59b4da790b414a97611a0d",
      "old_mode": 33261,
      "old_path": "t/t0003-attributes.sh",
      "new_id": "9d9aa2855d226feed852bfe968d8d1a27fcf447e",
      "new_mode": 33261,
      "new_path": "t/t0003-attributes.sh"
    }
  ]
}