Subject: [PATCH v4 2/5] strbuf_attach: fix all call sites to pass correct alloc

From: "Vaidas Pilkauskas via GitGitGadget" <[email-masked]>
Date: Wed, 18 Feb 2026 14:09:05 +0000

From: Vaidas Pilkauskas <[email-masked]>

strbuf_attach(sb, buf, len, alloc) requires alloc > len (the buffer
must have at least len+1 bytes to hold the NUL). Several call sites
passed alloc == len, relying on strbuf_grow(sb, 0) inside strbuf_attach
to reallocate. Prepare for changing that by fixing call sites to pass
the correct alloc.

- mailinfo, am, refs/files-backend, fast-import, trailer: pass len+1
  when the buffer is a NUL-terminated string (or from strbuf_detach).
- rerere, apply: ll_merge returns a buffer with exactly result.size
  bytes (no extra NUL). Use strbuf_add() to copy and NUL-terminate
  into the strbuf, then free the merge result, so alloc is correct.

Signed-off-by: Vaidas Pilkauskas <[email-masked]>
---
 apply.c               | 3 ++-
 builtin/am.c          | 2 +-
 builtin/fast-import.c | 2 +-
 mailinfo.c            | 2 +-
 refs/files-backend.c  | 2 +-
 rerere.c              | 3 ++-
 trailer.c             | 2 +-
 7 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/apply.c b/apply.c
index e4c4bf7af9..d67d86bce4 100644
--- a/apply.c
+++ b/apply.c
@@ -3589,7 +3589,8 @@ static int three_way_merge(struct apply_state *state,
 		return -1;
 	}
 	image_clear(image);
-	strbuf_attach(&image->buf, result.ptr, result.size, result.size);
+	strbuf_add(&image->buf, result.ptr, result.size);
+	free(result.ptr);
 
 	return status;
 }
diff --git a/builtin/am.c b/builtin/am.c
index e0c767e223..c439f868dc 100644
--- a/builtin/am.c
+++ b/builtin/am.c
@@ -1188,7 +1188,7 @@ static void am_append_signoff(struct am_state *state)
 {
 	struct strbuf sb = STRBUF_INIT;
 
-	strbuf_attach(&sb, state->msg, state->msg_len, state->msg_len);
+	strbuf_attach(&sb, state->msg, state->msg_len, state->msg_len + 1);
 	append_signoff(&sb, 0, 0);
 	state->msg = strbuf_detach(&sb, &state->msg_len);
 }
diff --git a/builtin/fast-import.c b/builtin/fast-import.c
index b8a7757cfd..164d8a6198 100644
--- a/builtin/fast-import.c
+++ b/builtin/fast-import.c
@@ -3246,7 +3246,7 @@ static void cat_blob(struct object_entry *oe, struct object_id *oid)
 	cat_blob_write("\n", 1);
 	if (oe && oe->pack_id == pack_id) {
 		last_blob.offset = oe->idx.offset;
-		strbuf_attach(&last_blob.data, buf, size, size);
+		strbuf_attach(&last_blob.data, buf, size, size + 1);
 		last_blob.depth = oe->depth;
 	} else
 		free(buf);
diff --git a/mailinfo.c b/mailinfo.c
index a2f06dbd96..13949ff31e 100644
--- a/mailinfo.c
+++ b/mailinfo.c
@@ -470,7 +470,7 @@ static int convert_to_utf8(struct mailinfo *mi,
 		return error("cannot convert from %s to %s",
 			     charset, mi->metainfo_charset);
 	}
-	strbuf_attach(line, out, out_len, out_len);
+	strbuf_attach(line, out, out_len, out_len + 1);
 	return 0;
 }
 
diff --git a/refs/files-backend.c b/refs/files-backend.c
index b1b13b41f6..6baba11f96 100644
--- a/refs/files-backend.c
+++ b/refs/files-backend.c
@@ -1806,7 +1806,7 @@ static int commit_ref(struct ref_lock *lock)
 		size_t len = strlen(path);
 		struct strbuf sb_path = STRBUF_INIT;
 
-		strbuf_attach(&sb_path, path, len, len);
+		strbuf_attach(&sb_path, path, len, len + 1);
 
 		/*
 		 * If this fails, commit_lock_file() will also fail
diff --git a/rerere.c b/rerere.c
index 6ec55964e2..2f4809a310 100644
--- a/rerere.c
+++ b/rerere.c
@@ -1031,7 +1031,8 @@ static int handle_cache(struct index_state *istate,
 	else
 		io.io.output = NULL;
 	strbuf_init(&io.input, 0);
-	strbuf_attach(&io.input, result.ptr, result.size, result.size);
+	strbuf_add(&io.input, result.ptr, result.size);
+	free(result.ptr);
 
 	/*
 	 * Grab the conflict ID and optionally write the original
diff --git a/trailer.c b/trailer.c
index 911a81ed99..3afe368db0 100644
--- a/trailer.c
+++ b/trailer.c
@@ -1009,7 +1009,7 @@ static struct trailer_block *trailer_block_get(const struct process_trailer_opti
 	for (ptr = trailer_lines; *ptr; ptr++) {
 		if (last && isspace((*ptr)->buf[0])) {
 			struct strbuf sb = STRBUF_INIT;
-			strbuf_attach(&sb, *last, strlen(*last), strlen(*last));
+			strbuf_attach(&sb, *last, strlen(*last), strlen(*last) + 1);
 			strbuf_addbuf(&sb, *ptr);
 			*last = strbuf_detach(&sb, NULL);
 			continue;
-- 
gitgitgadget