diff options
author | Christian Schlack <christian@backhub.co> | 2018-08-11 13:06:14 +0200 |
---|---|---|
committer | Christian Schlack <christian@backhub.co> | 2018-08-17 09:50:17 +0200 |
commit | 50dd7fea5ad1bf6c013b72ad0aa803a9c84cdede (patch) | |
tree | 792611880ae65ada03c2093f347b274fb5d7011a | |
parent | 9913e2df077fd9ed4c0fd5f81075ca5a153cd34b (diff) | |
download | libgit2-50dd7fea5ad1bf6c013b72ad0aa803a9c84cdede.tar.gz |
Fix 'invalid packet line' for ng packets containing errors
-rw-r--r-- | src/transports/smart_pkt.c | 16 |
1 files changed, 9 insertions, 7 deletions
diff --git a/src/transports/smart_pkt.c b/src/transports/smart_pkt.c index 1cc4252d5..00798c396 100644 --- a/src/transports/smart_pkt.c +++ b/src/transports/smart_pkt.c @@ -282,7 +282,7 @@ static int ok_pkt(git_pkt **out, const char *line, size_t len) static int ng_pkt(git_pkt **out, const char *line, size_t len) { git_pkt_ng *pkt; - const char *ptr; + const char *ptr, *eol; size_t alloclen; pkt = git__malloc(sizeof(*pkt)); @@ -291,11 +291,13 @@ static int ng_pkt(git_pkt **out, const char *line, size_t len) pkt->ref = NULL; pkt->type = GIT_PKT_NG; + eol = line + len; + if (len < 3) goto out_err; line += 3; /* skip "ng " */ - len -= 3; - if (!(ptr = memchr(line, ' ', len))) + + if (!(ptr = memchr(line, ' ', eol - line))) goto out_err; len = ptr - line; @@ -306,11 +308,11 @@ static int ng_pkt(git_pkt **out, const char *line, size_t len) memcpy(pkt->ref, line, len); pkt->ref[len] = '\0'; - if (len < 1) - goto out_err; line = ptr + 1; - len -= 1; - if (!(ptr = memchr(line, '\n', len))) + if (line >= eol) + goto out_err; + + if (!(ptr = memchr(line, '\n', eol - line))) goto out_err; len = ptr - line; |