On Thu, Oct 20, 2011 at 11:36:48AM -0700, Junio C Hamano wrote: > It probably is not worth it for most applications, but this fix-up to a > fairly recent one is worth doing, I would suspect. > > -- >8 -- > Subject: parse_signed_commit: really use the entire commit log message > > ... even beyond the first NUL in the buffer, when checking the commit > against the detached signature in the header. Yeah, that is worth fixing, I think. It's one thing to be a little lazy in pretty-printing for "git log", but I think signature verification should be more careful. Patch itself looks sane to me. There's still some use of str-like functions, but they would prevent us from even seeing the signature headers in the first place, so anything with a NUL that high is just broken and crappy. I didn't check, but I wonder if fsck does/should check that there is a proper end-of-header blank line before we hit any NUL. -Peff -- To unsubscribe from this list: send the line "unsubscribe git" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html