Commit 983f72c545fed631cc64bacda8d9058b5ccb2a84

Patrick Steinhardt 2018-06-25T13:52:25

Merge pull request #4696 from nelhage/git_pkt_ref-check-len Verify ref_pkt's are long enough

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
diff --git a/src/transports/smart_pkt.c b/src/transports/smart_pkt.c
index 4824330..43c7874 100644
--- a/src/transports/smart_pkt.c
+++ b/src/transports/smart_pkt.c
@@ -216,6 +216,11 @@ static int ref_pkt(git_pkt **out, const char *line, size_t len)
 	git_pkt_ref *pkt;
 	size_t alloclen;
 
+	if (len < GIT_OID_HEXSZ + 1) {
+		giterr_set(GITERR_NET, "error parsing pkt-line");
+		return -1;
+	}
+
 	pkt = git__malloc(sizeof(git_pkt_ref));
 	GITERR_CHECK_ALLOC(pkt);