thodg/libgit2/src

Diff

  • Show log

    Commit

  • Hash : 61165dd4
    Author : Patrick Steinhardt
    Date : 2018-10-18T11:43:30 

    tree-cache: avoid out-of-bound reads when parsing trees

We use the `git__strtol32` function to parse the child and entry count
of treecaches from the index, which do not accept a buffer length. As
the buffer that is being passed in is untrusted data and may thus be
malformed and may not contain a terminating `NUL` byte, we can overrun
the buffer and thus perform an out-of-bounds read.

Fix the issue by uzing `git__strntol32` instead.

(cherry picked from commit 21652ee9de439e042cc2e69b208aa2ef8ce31147)

kmx.io     mail     discord kmxgit v0.4.0