This series fixes a regression in v2.11.1 where we might read past the end of an mmap'd buffer. It was introduced in cf3c635210, but I didn't base the patch on there, for a few reasons: 1. There's a trivial conflict when merging up (because of git_open_noatime() becoming just git_open() in the inerim). 2. The reproduction advice relies on our SANITIZE Makefile knob, which didn't exist back then. 3. The second patch does not apply there because we don't have warn_on_fopen_errors(). Though admittedly it could be applied separately after merging up; it's just a clean-up on top. It does apply on the current "maint". [1/2]: read_info_alternates: read contents into strbuf [2/2]: read_info_alternates: warn on non-trivial errors sha1_file.c | 30 ++++++++++-------------------- 1 file changed, 10 insertions(+), 20 deletions(-) -Peff