Commit c2dd895a8df51d0a012e7780380f46bd60dde432
2019-08-08T10:47:29
transports: http: check for memory allocation failures When allocating a chunk that is used to write to HTTP streams, we do not check for memory allocation errors. This may lead us to write to a `NULL` pointer and thus cause a segfault. Fix this by adding a call to `GIT_ERROR_CHECK_ALLOC`.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40
diff --git a/src/transports/http.c b/src/transports/http.c
index d727851..a55aec5 100644
--- a/src/transports/http.c
+++ b/src/transports/http.c
@@ -1337,8 +1337,10 @@ static int http_stream_write_chunked(
/* Append as much to the buffer as we can */
int count = min(CHUNK_SIZE - s->chunk_buffer_len, len);
- if (!s->chunk_buffer)
+ if (!s->chunk_buffer) {
s->chunk_buffer = git__malloc(CHUNK_SIZE);
+ GIT_ERROR_CHECK_ALLOC(s->chunk_buffer);
+ }
memcpy(s->chunk_buffer + s->chunk_buffer_len, buffer, count);
s->chunk_buffer_len += count;
diff --git a/src/transports/winhttp.c b/src/transports/winhttp.c
index 7fc6b70..3cab5d7 100644
--- a/src/transports/winhttp.c
+++ b/src/transports/winhttp.c
@@ -1011,6 +1011,7 @@ replay:
}
buffer = git__malloc(CACHED_POST_BODY_BUF_SIZE);
+ GIT_ERROR_CHECK_ALLOC(buffer);
while (len > 0) {
DWORD bytes_written;
@@ -1392,8 +1393,10 @@ static int winhttp_stream_write_chunked(
/* Append as much to the buffer as we can */
int count = (int)min(CACHED_POST_BODY_BUF_SIZE - s->chunk_buffer_len, len);
- if (!s->chunk_buffer)
+ if (!s->chunk_buffer) {
s->chunk_buffer = git__malloc(CACHED_POST_BODY_BUF_SIZE);
+ GIT_ERROR_CHECK_ALLOC(s->chunk_buffer);
+ }
memcpy(s->chunk_buffer + s->chunk_buffer_len, buffer, count);
s->chunk_buffer_len += count;