Re: Still unsafe: write_sha1_from_fd()

Linus Torvalds [off-list ref] writes:

The only user is apparently ssh-fetch, but especially since the input-fd 
is a network connection, it looks like it is not at all unlikely that this 
case will trigger - all it takes is somebody impatient waiting for a large 
object.

Ugh,

Ugh indeed.

I'd vote for renaming it to a less generic name, moving it out
of sha1_file.c -- make it static in ssh-fetch.c -- and slowly
deprecate the use of ssh-fetch/ssh-upload pair.

I do not see much point prefering it over the pack transfer
protocol anyway, if you already have ssh access to the box.