Nicolas Pitre <nico@xxxxxxxxxxx> writes:
> /* Then the data itself.. */
> stream.next_in = buf;
> stream.avail_in = len;
> do {
> + unsigned char *in0 = stream.next_in;
> ret = deflate(&stream, Z_FINISH);
> + git_SHA1_Update(&c, in0, stream.next_in - in0);
Actually, I have to take my earlier comment back. This is not "paranoia".
I do not see anything that protects the memory area between in0 and
stream.next_in from getting modified while deflate() nor SHA1_Update() run
from the outside. Unless you copy the data away to somewhere stable at
the beginning of each iteration of this loop and run deflate() and
SHA1_Update(), you cannot have "paranoia".
My comment about "trickier" is about determining the size of that buffer
used as "somewhere stable".
--
To unsubscribe from this list: send the line "unsubscribe git" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html