http-push: widen start_put()'s size local from ssize_t to size_t

The local is initialised from git_deflate_bound() (an unsigned upper
bound on the deflated output, never negative) and used in exactly
three places: the initialising assignment, strbuf_grow(buf, size)
whose parameter is already size_t, and stream.avail_out which became
size_t in the prior commit. There is no comparison against zero or a
negative value, no subtraction, no arithmetic that depends on
signedness, and no path that would assign a signed quantity to it.

The original ssize_t was the wrong type to begin with: a
git_deflate_bound() result above SSIZE_MAX would have wrapped
negative on assignment and then implicitly re-extended to a huge
size_t at strbuf_grow() / stream.avail_out, requesting an absurd
allocation. That is not a real-world concern for the object sizes
http-push pushes today, but it is also the reason the type needs to
move to size_t before git_deflate_bound() itself is widened.

Assisted-by: Opus 4.7
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
This commit is contained in:
Johannes Schindelin
2026-06-05 12:12:57 +02:00
parent 6f78cfd30a
commit 7ee5a4ae68

View File

@@ -367,7 +367,7 @@ static void start_put(struct transfer_request *request)
void *unpacked;
size_t len;
int hdrlen;
ssize_t size;
size_t size;
git_zstream stream;
struct repo_config_values *cfg = repo_config_values(the_repository);