Commit 4947216fa528c0b4a8e1f64a8eb5f9152772cada
2019-01-21T11:11:27
git transport: only write INT_MAX bytes The transport code returns an `int` with the number of bytes written; thus only attempt to write at most `INT_MAX`.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44
diff --git a/src/transports/git.c b/src/transports/git.c
index b3f563d..8d5a9d9 100644
--- a/src/transports/git.c
+++ b/src/transports/git.c
@@ -75,14 +75,17 @@ static int gen_proto(git_buf *request, const char *cmd, const char *url)
static int send_command(git_proto_stream *s)
{
- int error;
git_buf request = GIT_BUF_INIT;
+ size_t write_size;
+ int error;
error = gen_proto(&request, s->cmd, s->url);
if (error < 0)
goto cleanup;
- error = git_stream_write(s->io, request.ptr, request.size, 0);
+ write_size = min(request.size, INT_MAX);
+ error = (int)git_stream_write(s->io, request.ptr, write_size, 0);
+
if (error >= 0)
s->sent_command = 1;
@@ -119,15 +122,16 @@ static int git_proto_stream_read(
static int git_proto_stream_write(
git_smart_subtransport_stream *stream,
const char *buffer,
- size_t len)
+ size_t buffer_len)
{
- int error;
git_proto_stream *s = (git_proto_stream *)stream;
+ size_t len = min(buffer_len, INT_MAX);
+ int error;
if (!s->sent_command && (error = send_command(s)) < 0)
return error;
- return git_stream_write(s->io, buffer, len, 0);
+ return (int)git_stream_write(s->io, buffer, len, 0);
}
static void git_proto_stream_free(git_smart_subtransport_stream *stream)