Re: [PATCH] daemon: Skip unknown "extra arg" information

Johannes Sixt [off-list ref] writes:

On Freitag, 5. Juni 2009, Shawn O. Pearce wrote:

quoted

Actually, we're already f'kd.  We can't change the protocol like
we had hoped.  I still think this should go in maint.

--8<--
daemon: Strictly parse the "extra arg" part of the command

Since 1.4.4.5 (49ba83fb67 "Add virtualization support to git-daemon")
git daemon enters an infinite loop and never terminates if a client
hides any extra arguments in the initial request line which is not
exactly "\0host=blah\0".

I see you applied this to maint. Since this patch actually fixes a 
DoS-exploitable bug, shouldn't it be applied all the way back to 1.4.4.5?

I personally do not have the bandwidth to worry about anything older than
say 1.6.0.  Interested parties (read: distro packagers who pride
themselves for their LTS) can do that themselves.