On Sat, Oct 10, 2026 at 02:15:29PM +0200, Stefan Sperling wrote:
> On Fri, Oct 09, 2026 at 04:41:19PM +0200, Theo Buehler wrote:
> > On Fri, Oct 09, 2026 at 04:39:03PM +0200, Stefan Sperling wrote:
> > > This looks like something Miod might be qualified to take a look at?
> > 
> > These files both have pretty huge structures on the stack. Might this be
> > releated?
> 
> In that case, the following diff might help:

I missed got-fetch-http, which also has a missing bounds check I am adding.

 
M  libexec/got-fetch-http/got-fetch-http.c  |  20+  7-

1 file changed, 20 insertions(+), 7 deletions(-)

commit - 22805600d8994acd612c568d0013c48a4476e16d
commit + 0d94f4f452ee327a95f38015b32ae4fb82ad03b2
blob - 8550578aa59341711d9c03188a0adc6f0d0fe04b
blob + 7d4cb06c6a4d75d82c1431b1f4ce06158496e793
--- libexec/got-fetch-http/got-fetch-http.c
+++ libexec/got-fetch-http/got-fetch-http.c
@@ -353,10 +353,10 @@ http_chunk(struct bufio *bio, const void *buf, size_t 
 }
 
 static int
-get_refs(int https, const char *host, const char *port, const char *path)
+get_refs(int https, const char *host, const char *port, const char *path,
+    char *buf, const size_t bufsize)
 {
 	struct bufio		 bio;
-	char			 buf[GOT_PKT_MAX];
 	const struct got_error	*e;
 	size_t			 chunksz = 0;
 	ssize_t			 r;
@@ -400,7 +400,7 @@ get_refs(int https, const char *host, const char *port
 	/* TODO: validate it's # service=git-upload-pack\n */
 	while (skip > 0) {
 		r = http_read(&bio, chunked, &chunksz, buf,
-		    MINIMUM(skip, sizeof(buf)), NULL);
+		    MINIMUM(skip, bufsize), NULL);
 		if (r <= 0)
 			goto err;
 		skip -= r;
@@ -417,10 +417,9 @@ err:
 
 static int
 upload_request(int https, const char *host, const char *port, const char *path,
-    FILE *in)
+    FILE *in, char *buf, const size_t bufsize)
 {
 	struct bufio		 bio;
-	char			 buf[GOT_PKT_MAX];
 	const struct got_error	*e;
 	ssize_t			 r;
 	size_t			 chunksz = 0;
@@ -477,6 +476,11 @@ upload_request(int https, const char *host, const char
 			goto err;
 		}
 
+		if (t > bufsize) {
+			warnx("pktline len is too large");
+			goto err;
+		}
+
 		r = fread(buf + 4, 1, t - 4, in);
 		if (r != t - 4)
 			goto err;
@@ -524,6 +528,8 @@ main(int argc, char **argv)
 	char		*path;
 	int		 https = 0;
 	int		 ch;
+	char		*buf = NULL;
+	const size_t	 bufsize = GOT_PKT_MAX;
 
 #ifndef PROFILE
 	if (pledge("stdio rpath inet dns unveil", NULL) == -1)
@@ -570,7 +576,11 @@ main(int argc, char **argv)
 	path = argv[3];
 	got_path_strip_trailing_slashes(path);
 
-	if (get_refs(https, host, port, path) == -1)
+	buf = calloc(1, bufsize);
+	if (buf == NULL)
+		err(1, "calloc");
+
+	if (get_refs(https, host, port, path, buf, bufsize) == -1)
 		errx(1, "failed to get refs");
 
 	pfd.fd = 0;
@@ -582,9 +592,12 @@ main(int argc, char **argv)
 		return 0;
 
 	ungetc(ch, stdin);
-	if (upload_request(https, host, port, path, stdin) == -1) {
+	memset(buf, '\0', bufsize);
+	if (upload_request(https, host, port, path, stdin,
+	    buf, bufsize) == -1) {
 		errx(1, "failed to upload request");
 	}
 
+	free(buf);
 	return 0;
 }