Git security audit: Inside the hunt for - and discovery of - CVEs

This post details the discovery and mitigation of CVE-2022-41903, a heap corruption vulnerability in Git's `git archive` command related to `export-subst` attributes and padding specifiers in pretty formats. It describes the collaborative process involving GitLab, X41 D-Sec, and OSTIF, the technical details of identifying the vulnerability through code analysis and proof-of-concept, and the subsequent collaboration with the git-security mailing list for fixes and further fuzzing harness extension.