While looking at [1], I noticed that v2 servers will read a few bits of client input into strvecs. Even though we expect these to be small-ish, there's nothing preventing a client from sending us a bunch of junk and wasting memory. This series changes that, putting a cap on how much data we'll receive. The two spots are the "capabilities" list we receive (before we even dispatch to a particular command like ls-refs or fetch), and the ref-prefix list we receive for ls-refs. To deal with the capabilities issue, we'll just handle each capability line as it comes in, rather than storing a list. This requires a bit of cleanup, which is why it takes up the first 6 patches. It also needs a few other cleanups from ab/serve-cleanup (and so this series is based on that). The dependencies there are both textual (e.g., using designated initializers in the capabilities table) and functional (dropping the "keys" parameter from v2 command() functions). Patch 7 fixes the ls-refs issue by degrading when we see too many prefixes (which works because the capability is optional in the first place). The final two patches aren't strictly necessary. They're a tightening of the protocol against some bogus input that I noticed while doing the earlier cleanups. That bogus input isn't really hurting anything, but I think it makes sense to reject nonsense from the client rather than ignoring it. The obvious risk is that some client for some reason would send us nonsense, but I don't think Git ever has. Once again, these are based on ab/serve-cleanup, which is currently in next. [1/9]: serve: rename is_command() to parse_command() [2/9]: serve: return capability "value" from get_capability() [3/9]: serve: add "receive" method for v2 capabilities table [4/9]: serve: provide "receive" function for object-format capability [5/9]: serve: provide "receive" function for session-id capability [6/9]: serve: drop "keys" strvec [7/9]: ls-refs: ignore very long ref-prefix counts [8/9]: serve: reject bogus v2 "command=ls-refs=foo" [9/9]: serve: reject commands used as capabilities ls-refs.c | 19 ++++++- serve.c | 120 +++++++++++++++++++++++-------------------- t/t5701-git-serve.sh | 60 ++++++++++++++++++++++ 3 files changed, 142 insertions(+), 57 deletions(-) -Peff [1] https://lore.kernel.org/git/YT54CNYgtGcqexwq@xxxxxxxxxxxxxxxxxxxxxxx/
