These fix got-fetch-pack, and gotsh builds for me.
There's a couple of -Werror things I'll get back at separately.

Haven't looked too closely at the diff, but wouldn't it make sense to
use asprintf instead of calloc+snprintf, and strdup instead of calloc+
strlcpy?

martijn@

On 10/10/26 14:30, Stefan Sperling wrote:
> On Sat, Oct 10, 2026 at 02:15:29PM +0200, Stefan Sperling wrote:
>> On Fri, Oct 09, 2026 at 04:41:19PM +0200, Theo Buehler wrote:
>>> On Fri, Oct 09, 2026 at 04:39:03PM +0200, Stefan Sperling wrote:
>>>> This looks like something Miod might be qualified to take a look at?
>>>
>>> These files both have pretty huge structures on the stack. Might this be
>>> releated?
>>
>> In that case, the following diff might help:
> 
> I missed got-fetch-http, which also has a missing bounds check I am adding.
> 
>  
> M  libexec/got-fetch-http/got-fetch-http.c  |  20+  7-
> 
> 1 file changed, 20 insertions(+), 7 deletions(-)
> 
> commit - 22805600d8994acd612c568d0013c48a4476e16d
> commit + 0d94f4f452ee327a95f38015b32ae4fb82ad03b2
> blob - 8550578aa59341711d9c03188a0adc6f0d0fe04b
> blob + 7d4cb06c6a4d75d82c1431b1f4ce06158496e793
> --- libexec/got-fetch-http/got-fetch-http.c
> +++ libexec/got-fetch-http/got-fetch-http.c
> @@ -353,10 +353,10 @@ http_chunk(struct bufio *bio, const void *buf, size_t 
>  }
>  
>  static int
> -get_refs(int https, const char *host, const char *port, const char *path)
> +get_refs(int https, const char *host, const char *port, const char *path,
> +    char *buf, const size_t bufsize)
>  {
>  	struct bufio		 bio;
> -	char			 buf[GOT_PKT_MAX];
>  	const struct got_error	*e;
>  	size_t			 chunksz = 0;
>  	ssize_t			 r;
> @@ -400,7 +400,7 @@ get_refs(int https, const char *host, const char *port
>  	/* TODO: validate it's # service=git-upload-pack\n */
>  	while (skip > 0) {
>  		r = http_read(&bio, chunked, &chunksz, buf,
> -		    MINIMUM(skip, sizeof(buf)), NULL);
> +		    MINIMUM(skip, bufsize), NULL);
>  		if (r <= 0)
>  			goto err;
>  		skip -= r;
> @@ -417,10 +417,9 @@ err:
>  
>  static int
>  upload_request(int https, const char *host, const char *port, const char *path,
> -    FILE *in)
> +    FILE *in, char *buf, const size_t bufsize)
>  {
>  	struct bufio		 bio;
> -	char			 buf[GOT_PKT_MAX];
>  	const struct got_error	*e;
>  	ssize_t			 r;
>  	size_t			 chunksz = 0;
> @@ -477,6 +476,11 @@ upload_request(int https, const char *host, const char
>  			goto err;
>  		}
>  
> +		if (t > bufsize) {
> +			warnx("pktline len is too large");
> +			goto err;
> +		}
> +
>  		r = fread(buf + 4, 1, t - 4, in);
>  		if (r != t - 4)
>  			goto err;
> @@ -524,6 +528,8 @@ main(int argc, char **argv)
>  	char		*path;
>  	int		 https = 0;
>  	int		 ch;
> +	char		*buf = NULL;
> +	const size_t	 bufsize = GOT_PKT_MAX;
>  
>  #ifndef PROFILE
>  	if (pledge("stdio rpath inet dns unveil", NULL) == -1)
> @@ -570,7 +576,11 @@ main(int argc, char **argv)
>  	path = argv[3];
>  	got_path_strip_trailing_slashes(path);
>  
> -	if (get_refs(https, host, port, path) == -1)
> +	buf = calloc(1, bufsize);
> +	if (buf == NULL)
> +		err(1, "calloc");
> +
> +	if (get_refs(https, host, port, path, buf, bufsize) == -1)
>  		errx(1, "failed to get refs");
>  
>  	pfd.fd = 0;
> @@ -582,9 +592,12 @@ main(int argc, char **argv)
>  		return 0;
>  
>  	ungetc(ch, stdin);
> -	if (upload_request(https, host, port, path, stdin) == -1) {
> +	memset(buf, '\0', bufsize);
> +	if (upload_request(https, host, port, path, stdin,
> +	    buf, bufsize) == -1) {
>  		errx(1, "failed to upload request");
>  	}
>  
> +	free(buf);
>  	return 0;
>  }