thodg/libgit2/src

Diff

  • Show log

    Commit

  • Hash : ee11d47e
    Author : Patrick Steinhardt
    Date : 2018-10-19T09:47:50 

    tag: fix out of bounds read when searching for tag message

When parsing tags, we skip all unknown fields that appear before the tag
message. This skipping is done by using a plain `strstr(buffer, "\n\n")`
to search for the two newlines that separate tag fields from tag
message. As it is not possible to supply a buffer length to `strstr`,
this call may skip over the buffer's end and thus result in an out of
bounds read. As `strstr` may return a pointer that is out of bounds, the
following computation of `buffer_end - buffer` will overflow and result
in an allocation of an invalid length.

Fix the issue by using `git__memmem` instead. Add a test that verifies
parsing the tag fails not due to the allocation failure but due to the
tag having no message.

kmx.io     mail     discord kmxgit v0.4.0