On Feb 18, 2008 10:56 AM, Hyrum K. Wright <hyrum_wright_at_mail.utexas.edu> wrote:
>
> David Glasser wrote:
> > On Feb 18, 2008 10:38 AM, Hyrum K. Wright <hyrum_wright_at_mail.utexas.edu> wrote:
> >> Hyrum K. Wright wrote:
> >>> David Glasser wrote:
> >>> ...
> >>>> * svn_rangelist_count_revs, svn_rangelist_to_revs, and
> >>>> svn_range_compact are never used outside of the test suite. Do we
> >>>> need them? I guess the first two might hypothetically be useful to
> >>>> other clients. What about svn_range_compact?
> >>> The first two were originally were part of 'log -g'. Their usefulness
> >>> may return before I'm finished with 'log -g', so I would wait until that
> >>> point to remove them.
> >> I've moved svn_rangelist_to_revs() to be a private function in
> >> libsvn_repos. It may still get cut, and I'd like to keep it out of the
> >> public API. svn_rangelist_count_revs() can be safely removed.
> >
> > Cool.
> >
> > btw, Hyrum and I talked about this on IRC the other day, but: I'm a
> > little worried that any codepath that uses svn_rangelist_to_revs (or
> > the new private version) is a potential DOS risk. If somebody can
> > check in a mergeinfo prop (or otherwise get svn_rangelist_to_revs
> > applied a string) containing "1-1000000000", any call to that function
> > will make the server slowly allocate a large amount of memory...
>
> True. I'm in the middle of a new rangelist-based algorithm to replace
> the need for rangelist_to_revs(), but if somebody else wants to take a
> look at it sooner, I'd have no objections. The current implementation
> is there because it was easier to conceptualize and implement, and so
> that folks can test the functionality of 'log -g' while I work on the
> rangelist-based approach.
Right. Or you could always just trim to youngest_rev at
rangelist_to_revs time, which at least puts somewhat of a bound on the
explosion.
--dave
--
David Glasser | glasser@davidglasser.net | http://www.davidglasser.net/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe_at_subversion.tigris.org
For additional commands, e-mail: dev-help_at_subversion.tigris.org
Received on 2008-02-18 20:02:48 CET