pkt: make sure we really only read the length

A pkt-line's length are described in its first four bytes in ASCII
hex. Copy this substring to another string before feeding it to
git__strtol32. Otherwise, it will read the whole hash.

Signed-off-by: Carlos Martín Nieto <carlos@cmartin.tk>

1 files changed, 16 insertions, 3 deletions

diff --git a/src/pkt.c b/src/pkt.c
index bf460e55d..782b88569 100644
--- a/src/pkt.c
+++ b/src/pkt.c
@@ -61,14 +61,27 @@ int git_pkt_parse_line(git_pkt **head, const char *line, const char **out)
 {
 	int error = GIT_SUCCESS;
 	long int len;
+	const int num_len = 4;
+	char *num;
 	const char *num_end;
 	git_pkt *pkt;
 
-	error = git__strtol32(&len, line, &num_end, 16);
-	if (error < GIT_SUCCESS)
+	num = git__strndup(line, num_len);
+	if (num == NULL)
+		return GIT_ENOMEM;
+
+	error = git__strtol32(&len, num, &num_end, 16);
+	if (error < GIT_SUCCESS) {
+		free(num);
 		return error;
+	}
+	if (num_end - num != num_len) {
+		free(num);
+		return git__throw(GIT_EOBJCORRUPTED, "Wrong pkt length");
+	}
+	free(num);
 
-	line = num_end;
+	line += num_len;
 	/*
 	 * TODO: How do we deal with empty lines? Try again? with the next
 	 * line?