From: Stefan Sperling Subject: Re: got fails to build on alpha To: Theo Buehler , Martijn van Duren , "gameoftrees@openbsd.org" Date: Sat, 10 Oct 2026 14:30:16 +0200 On Sat, Oct 10, 2026 at 02:15:29PM +0200, Stefan Sperling wrote: > On Fri, Oct 09, 2026 at 04:41:19PM +0200, Theo Buehler wrote: > > On Fri, Oct 09, 2026 at 04:39:03PM +0200, Stefan Sperling wrote: > > > This looks like something Miod might be qualified to take a look at? > > > > These files both have pretty huge structures on the stack. Might this be > > releated? > > In that case, the following diff might help: I missed got-fetch-http, which also has a missing bounds check I am adding. M libexec/got-fetch-http/got-fetch-http.c | 20+ 7- 1 file changed, 20 insertions(+), 7 deletions(-) commit - 22805600d8994acd612c568d0013c48a4476e16d commit + 0d94f4f452ee327a95f38015b32ae4fb82ad03b2 blob - 8550578aa59341711d9c03188a0adc6f0d0fe04b blob + 7d4cb06c6a4d75d82c1431b1f4ce06158496e793 --- libexec/got-fetch-http/got-fetch-http.c +++ libexec/got-fetch-http/got-fetch-http.c @@ -353,10 +353,10 @@ http_chunk(struct bufio *bio, const void *buf, size_t } static int -get_refs(int https, const char *host, const char *port, const char *path) +get_refs(int https, const char *host, const char *port, const char *path, + char *buf, const size_t bufsize) { struct bufio bio; - char buf[GOT_PKT_MAX]; const struct got_error *e; size_t chunksz = 0; ssize_t r; @@ -400,7 +400,7 @@ get_refs(int https, const char *host, const char *port /* TODO: validate it's # service=git-upload-pack\n */ while (skip > 0) { r = http_read(&bio, chunked, &chunksz, buf, - MINIMUM(skip, sizeof(buf)), NULL); + MINIMUM(skip, bufsize), NULL); if (r <= 0) goto err; skip -= r; @@ -417,10 +417,9 @@ err: static int upload_request(int https, const char *host, const char *port, const char *path, - FILE *in) + FILE *in, char *buf, const size_t bufsize) { struct bufio bio; - char buf[GOT_PKT_MAX]; const struct got_error *e; ssize_t r; size_t chunksz = 0; @@ -477,6 +476,11 @@ upload_request(int https, const char *host, const char goto err; } + if (t > bufsize) { + warnx("pktline len is too large"); + goto err; + } + r = fread(buf + 4, 1, t - 4, in); if (r != t - 4) goto err; @@ -524,6 +528,8 @@ main(int argc, char **argv) char *path; int https = 0; int ch; + char *buf = NULL; + const size_t bufsize = GOT_PKT_MAX; #ifndef PROFILE if (pledge("stdio rpath inet dns unveil", NULL) == -1) @@ -570,7 +576,11 @@ main(int argc, char **argv) path = argv[3]; got_path_strip_trailing_slashes(path); - if (get_refs(https, host, port, path) == -1) + buf = calloc(1, bufsize); + if (buf == NULL) + err(1, "calloc"); + + if (get_refs(https, host, port, path, buf, bufsize) == -1) errx(1, "failed to get refs"); pfd.fd = 0; @@ -582,9 +592,12 @@ main(int argc, char **argv) return 0; ungetc(ch, stdin); - if (upload_request(https, host, port, path, stdin) == -1) { + memset(buf, '\0', bufsize); + if (upload_request(https, host, port, path, stdin, + buf, bufsize) == -1) { errx(1, "failed to upload request"); } + free(buf); return 0; }