Residue of the 2026-07-24 jab/dog/git/ review: real but small defects
that don't warrant one ticket each. Each TODO is self-contained; fix
repro-first where a behavior changes, comment-only items need none.
The four big findings went to GIT-011 (extended), GIT-023,
GIT-024, GIT-025. Method: work.
dog/git/{GIT,PACK,DELT,ZINF,PKT,PIDX,CFG,IGNO,SUBS,SHA1}..gitmodules blobs arrive off the wire.GIT.c:163 git_drain_decimal: no overflow guard — a long digit
run in a commit ident is signed i64 overflow (UB); clamp digits.SHA1.h:17 sha1empty reads data[20] via u64c*/u32c* —
unaligned + strict-aliasing UB; byte-OR loop or memcmp vs zeros.CFG.c.rl: grammar requires a trailing \n — a config blob ending
mid-line (git-legal) yields CFGBAD; SUBS then fails the WHOLE
.gitmodules and drops the last submodule. Accept EOF as EOL.CFG.c.rl q_esc admits only \n \t \b \" \\ — git accepts ANY
backslash-escape in quoted strings; one \, fails the parse.GIT.c:348 GITFeedRef: u8bFeed returns unchecked → silent ref
truncation on a short buffer; call() them (abc.mkd feed rule).DELT.c:29 DELTApply never checks declared base_sz against the
actual $size(base) — a wrong base applies to plausible garbage
instead of DELTBADFMT (git verifies this).IGNO.c: glob lacks char classes [a-z] and backslash escapes —
such patterns silently never match; document or implement.IGNO.c ** matching is exponential-backtracking worst case;
IGNO_MAX_PATTERNS/IGNO_MAX_CHAIN overflow drops rules silently
(log or error, no silent cap).PKT.c:32 response-end (0002) is conflated with PKTFLUSH and
PKT.h doesn't say; PKT.c:36 payload_len is dead code.SHA1.h:124 sha1Drain does *from += 20 + memcpy — the banned
slice→pointer mode switch; u8csUsed + typed copy.SUBS.c:124 SUBSu8bSynth: hand-built slice literals with manual
length constants (use a_cstr); no escaping of "/\ in path →
.gitmodules injection from a hostile mount path.PACK.c:128 PACKu8sFeedObj comment claims "never leaves a
truncated record" — false on the error path (header+ofs already
fed, no rollback); fix the contract text or add rollback.PACK.c:51 / DELT.c:8 varint decoders silently drop bits at
shift ≥ ~58; add a range test so sizes can't alias.PIDX.c:62 pidx_emit_at inflates each record at least twice
(resolve + PACKRecordEnd) and re-resolves chains from scratch —
quadratic-ish on deep-delta logs; measure, then decide.