)]}'
{
  "commit": "447ac906e189535e77dcb1f4bbe3f1bc917d4c12",
  "tree": "73d4816197c9cefb7da828a153e61dde08aa5927",
  "parents": [
    "34ace8bad02bb14ecc5b631f7e3daaa7a9bba7d9"
  ],
  "author": {
    "name": "Patrick Steinhardt",
    "email": "ps@pks.im",
    "time": "Thu Dec 01 15:45:31 2022 +0100"
  },
  "committer": {
    "name": "Junio C Hamano",
    "email": "gitster@pobox.com",
    "time": "Mon Dec 05 15:14:16 2022 +0900"
  },
  "message": "attr: fix out-of-bounds read with unreasonable amount of patterns\n\nThe `struct attr_stack` tracks the stack of all patterns together with\ntheir attributes. When parsing a gitattributes file that has more than\n2^31 such patterns though we may trigger multiple out-of-bounds reads on\n64 bit platforms. This is because while the `num_matches` variable is an\nunsigned integer, we always use a signed integer to iterate over them.\n\nI have not been able to reproduce this issue due to memory constraints\non my systems. But despite the out-of-bounds reads, the worst thing that\ncan seemingly happen is to call free(3P) with a garbage pointer when\ncalling `attr_stack_free()`.\n\nFix this bug by using unsigned integers to iterate over the array. While\nthis makes the iteration somewhat awkward when iterating in reverse, it\nis at least better than knowingly running into an out-of-bounds read.\nWhile at it, convert the call to `ALLOC_GROW` to use `ALLOC_GROW_BY`\ninstead.\n\nSigned-off-by: Patrick Steinhardt \u003cps@pks.im\u003e\nSigned-off-by: Junio C Hamano \u003cgitster@pobox.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "525f6da2013feb8d9ba609f47c6ce390fcfa7480",
      "old_mode": 33188,
      "old_path": "attr.c",
      "new_id": "98c231d67582464c2309b534c41be28ed0854621",
      "new_mode": 33188,
      "new_path": "attr.c"
    }
  ]
}