)]}'
{
  "commit": "dfa6b32b5e599d97448337ed4fc18dd50c90758f",
  "tree": "de222f947bc34550334814028aa860e7a557e3c2",
  "parents": [
    "d74b1fd54fdbc45966d12ea907dece11e072fb2b"
  ],
  "author": {
    "name": "Patrick Steinhardt",
    "email": "ps@pks.im",
    "time": "Thu Dec 01 15:45:48 2022 +0100"
  },
  "committer": {
    "name": "Junio C Hamano",
    "email": "gitster@pobox.com",
    "time": "Mon Dec 05 15:33:07 2022 +0900"
  },
  "message": "attr: ignore attribute lines exceeding 2048 bytes\n\nThere are two different code paths to read gitattributes: once via a\nfile, and once via the index. These two paths used to behave differently\nbecause when reading attributes from a file, we used fgets(3P) with a\nbuffer size of 2kB. Consequentially, we silently truncate line lengths\nwhen lines are longer than that and will then parse the remainder of the\nline as a new pattern. It goes without saying that this is entirely\nunexpected, but it\u0027s even worse that the behaviour depends on how the\ngitattributes are parsed.\n\nWhile this is simply wrong, the silent truncation saves us with the\nrecently discovered vulnerabilities that can cause out-of-bound writes\nor reads with unreasonably long lines due to integer overflows. As the\ncommon path is to read gitattributes via the worktree file instead of\nvia the index, we can assume that any gitattributes file that had lines\nlonger than that is already broken anyway. So instead of lifting the\nlimit here, we can double down on it to fix the vulnerabilities.\n\nIntroduce an explicit line length limit of 2kB that is shared across all\npaths that read attributes and ignore any line that hits this limit\nwhile printing a warning.\n\nSigned-off-by: Patrick Steinhardt \u003cps@pks.im\u003e\nSigned-off-by: Junio C Hamano \u003cgitster@pobox.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "41657479fffbe2a7edd45614093ddc19d4878034",
      "old_mode": 33188,
      "old_path": "attr.c",
      "new_id": "38ecd2fff30d33a86ec11f16f454a0a504a15fa2",
      "new_mode": 33188,
      "new_path": "attr.c"
    },
    {
      "type": "modify",
      "old_id": "404548f028a8b8fa4e8836ef69867475810a0e15",
      "old_mode": 33188,
      "old_path": "attr.h",
      "new_id": "df9a75da550eb7f0fcd627dfee2e7e5ed098ae70",
      "new_mode": 33188,
      "new_path": "attr.h"
    },
    {
      "type": "modify",
      "old_id": "416386ce2f8924dc6cff9bbeba8b6063fac8251b",
      "old_mode": 33261,
      "old_path": "t/t0003-attributes.sh",
      "new_id": "7d68e6a56e964dda5f59b4da790b414a97611a0d",
      "new_mode": 33261,
      "new_path": "t/t0003-attributes.sh"
    }
  ]
}