summaryrefslogtreecommitdiff
path: root/http-push.c
diff options
context:
space:
mode:
authorJunio C Hamano <junkio@cox.net>2007-03-02 00:31:51 -0800
committerJunio C Hamano <junkio@cox.net>2007-03-02 00:31:51 -0800
commit8b969a5fb5e5891d9ad4c236fd9487c4673bfa2a (patch)
treed3f7a259c8cbd478e5def0136fa9bf81f6ec035a /http-push.c
parent112f63851bae2ff6f04092a2eb4261d6e5990c65 (diff)
parenteecc8367f4eaafc8449fc08c4e33f3f8ac474469 (diff)
downloadgit-8b969a5fb5e5891d9ad4c236fd9487c4673bfa2a.tar.gz
Merge branch 'maint'
* maint: Another memory overrun in http-push.c fetch.o depends on the headers, too. Documentation: Correct minor typo in git-add documentation. Documentation/git-send-email.txt: Fix labeled list formatting Documentation/git-quiltimport.txt: Fix labeled list formatting Documentation/build-docdep.perl: Fix dependencies for included asciidoc files
Diffstat (limited to 'http-push.c')
-rw-r--r--http-push.c10
1 files changed, 7 insertions, 3 deletions
diff --git a/http-push.c b/http-push.c
index 68b78b538a..cbb02d3bc1 100644
--- a/http-push.c
+++ b/http-push.c
@@ -1271,7 +1271,9 @@ xml_cdata(void *userData, const XML_Char *s, int len)
struct xml_ctx *ctx = (struct xml_ctx *)userData;
free(ctx->cdata);
ctx->cdata = xmalloc(len + 1);
- strlcpy(ctx->cdata, s, len + 1);
+ /* NB: 's' is not null-terminated, can not use strlcpy here */
+ memcpy(ctx->cdata, s, len);
+ ctx->cdata[len] = '\0';
}
static struct remote_lock *lock_remote(const char *path, long timeout)
@@ -1473,7 +1475,8 @@ static void process_ls_object(struct remote_ls_ctx *ls)
return;
path += 8;
obj_hex = xmalloc(strlen(path));
- strlcpy(obj_hex, path, 3);
+ /* NB: path is not null-terminated, can not use strlcpy here */
+ memcpy(obj_hex, path, 2);
strcpy(obj_hex + 2, path + 3);
one_remote_object(obj_hex);
free(obj_hex);
@@ -2170,7 +2173,8 @@ static void fetch_symref(const char *path, char **symref, unsigned char *sha1)
/* If it's a symref, set the refname; otherwise try for a sha1 */
if (!prefixcmp((char *)buffer.buffer, "ref: ")) {
*symref = xmalloc(buffer.posn - 5);
- strlcpy(*symref, (char *)buffer.buffer + 5, buffer.posn - 5);
+ memcpy(*symref, (char *)buffer.buffer + 5, buffer.posn - 6);
+ (*symref)[buffer.posn - 6] = '\0';
} else {
get_sha1_hex(buffer.buffer, sha1);
}