GeezerVison

`Commit.co_authors` matched `^Co-authored-by: (.*) <(.*?)>$` against the
whole commit message. On a single trailer line that repeats `` <`` without
ever closing a `>`, the greedy `(.*)` backtracks over every `` <`` position
and, for each, the lazy `(.*?)` rescans to the end of the line looking for a
`>` that never arrives. That is O(n^2) in the length of the line.

The commit message is fully attacker-controlled: it comes straight from the
object bytes decoded in `_deserialize`, so a repository can ship a commit
whose message is a few hundred KB of `Co-authored-by: a <a <a <...`. Any
caller that reads `commit.co_authors` (a public property) then stalls. A
60 KB line already costs several seconds of CPU; a few hundred KB reaches
minutes.

Parse each `Co-authored-by:` line with string operations instead of a
backtracking regex: a trailer is `Co-authored-by: <name> <email>` with the
email in the final angle brackets, so the name ends at the last `` <`` and
the line ends at `>`. This reproduces the previous results exactly
(verified against the old pattern over ~1.8M fuzzed inputs, including the
existing `test_commit_co_authors` cases) while running in linear time: the
same crafted input drops from seconds to microseconds.

Add a CPU-time regression test that fails on the old code and passes here,
and confirm a well-formed trailer on a later line is still parsed.

Copilot AI left a comment

Byron left a comment