vulnerabilities from original libgit2 not fixed here

[dm9pZCAq]

there are few vulnerabilities which is fixed in original libgit2 which is still present in this fork: https://github.com/libgit2/libgit2/security

[romkatv]

This fork is used only by gitstatusd. These functions aren't used there.

[dm9pZCAq]

revparse is used but it looks like this part is before vulnerability is introduced

libgit2/src/revparse.c

Lines 773 to 790 in 2ecf339

	case '@':
	if (spec[pos+1] == '{') {
	git_object *temp_object = NULL;
	if ((error = extract_curly_braces_content(&buf, spec, &pos)) < 0)
	goto cleanup;
	if ((error = ensure_base_rev_is_not_known_yet(base_rev)) < 0)
	goto cleanup;
	if ((error = handle_at_syntax(&temp_object, &reference, spec, identifier_len, repo, git_buf_cstr(&buf))) < 0)
	goto cleanup;
	if (temp_object != NULL)
	base_rev = temp_object;
	break;
	}
	/* fall through */

[romkatv]

Thanks for checking!