Johannes Sixt <j6t@xxxxxxxx> writes: > On Freitag, 5. Juni 2009, Shawn O. Pearce wrote: >> Actually, we're already f'kd. We can't change the protocol like >> we had hoped. I still think this should go in maint. >> >> --8<-- >> daemon: Strictly parse the "extra arg" part of the command >> >> Since 1.4.4.5 (49ba83fb67 "Add virtualization support to git-daemon") >> git daemon enters an infinite loop and never terminates if a client >> hides any extra arguments in the initial request line which is not >> exactly "\0host=blah\0". > > I see you applied this to maint. Since this patch actually fixes a > DoS-exploitable bug, shouldn't it be applied all the way back to 1.4.4.5? I personally do not have the bandwidth to worry about anything older than say 1.6.0. Interested parties (read: distro packagers who pride themselves for their LTS) can do that themselves. -- To unsubscribe from this list: send the line "unsubscribe git" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html