Commit f8f7c882a202ae17391b28587d013b5dd2809366

Stefan Sperling 2020-07-23T14:21:28

fix buffer overflow in got_tree_entry_get_symlink_target()

1
2
3
4
5
6
7
8
9
10
11
12
13
diff --git a/lib/object.c b/lib/object.c
index 450df8e..525bbd9 100644
--- a/lib/object.c
+++ b/lib/object.c
@@ -901,7 +901,7 @@ got_tree_entry_get_symlink_target(char **link_target, struct got_tree_entry *te,
 		*link_target = p;
 		/* Skip blob object header first time around. */
 		memcpy(*link_target,
-		    got_object_blob_get_read_buf(blob) + hdrlen, len);
+		    got_object_blob_get_read_buf(blob) + hdrlen, len - hdrlen);
 		hdrlen = 0;
 	} while (len > 0);
 	(*link_target)[totlen] = '\0';