Merge pull request #4758 from pks-t/pks/smart-pkt-oob-read smart_pkt: fix potential OOB-read when processing ng packet
diff --git a/src/transports/smart_pkt.c b/src/transports/smart_pkt.c
index cd9ca6c..1cc4252 100644
--- a/src/transports/smart_pkt.c
+++ b/src/transports/smart_pkt.c
@@ -291,8 +291,11 @@ static int ng_pkt(git_pkt **out, const char *line, size_t len)
pkt->ref = NULL;
pkt->type = GIT_PKT_NG;
+ if (len < 3)
+ goto out_err;
line += 3; /* skip "ng " */
- if (!(ptr = strchr(line, ' ')))
+ len -= 3;
+ if (!(ptr = memchr(line, ' ', len)))
goto out_err;
len = ptr - line;
@@ -303,8 +306,11 @@ static int ng_pkt(git_pkt **out, const char *line, size_t len)
memcpy(pkt->ref, line, len);
pkt->ref[len] = '\0';
+ if (len < 1)
+ goto out_err;
line = ptr + 1;
- if (!(ptr = strchr(line, '\n')))
+ len -= 1;
+ if (!(ptr = memchr(line, '\n', len)))
goto out_err;
len = ptr - line;