diff options
author | Junio C Hamano <gitster@pobox.com> | 2016-10-12 00:21:03 +0300 |
---|---|---|
committer | Junio C Hamano <gitster@pobox.com> | 2016-10-12 00:21:03 +0300 |
commit | f7f0a87e0a27a1baaf782af7cec18fd23fdf35de (patch) | |
tree | 7985c724684b4224e762e788fdb8c85752d0e83a /sha1_file.c | |
parent | 0bc409dab941d7df065c486342cefcde78647c42 (diff) | |
parent | d21f8426907e84465ab54df5b05bc81057f448d9 (diff) |
Merge branch 'jc/verify-loose-object-header' into maint
Codepaths that read from an on-disk loose object were too loose in
validating what they are reading is a proper object file and
sometimes read past the data they read from the disk, which has
been corrected. H/t to Gustavo Grieco for reporting.
* jc/verify-loose-object-header:
unpack_sha1_header(): detect malformed object header
streaming: make sure to notice corrupt object
Diffstat (limited to 'sha1_file.c')
-rw-r--r-- | sha1_file.c | 26 |
1 files changed, 24 insertions, 2 deletions
diff --git a/sha1_file.c b/sha1_file.c index 3045aeabda..7a4f8f8661 100644 --- a/sha1_file.c +++ b/sha1_file.c @@ -1572,7 +1572,9 @@ unsigned long unpack_object_header_buffer(const unsigned char *buf, return used; } -int unpack_sha1_header(git_zstream *stream, unsigned char *map, unsigned long mapsize, void *buffer, unsigned long bufsiz) +static int unpack_sha1_short_header(git_zstream *stream, + unsigned char *map, unsigned long mapsize, + void *buffer, unsigned long bufsiz) { /* Get the data stream */ memset(stream, 0, sizeof(*stream)); @@ -1585,13 +1587,31 @@ int unpack_sha1_header(git_zstream *stream, unsigned char *map, unsigned long ma return git_inflate(stream, 0); } +int unpack_sha1_header(git_zstream *stream, + unsigned char *map, unsigned long mapsize, + void *buffer, unsigned long bufsiz) +{ + int status = unpack_sha1_short_header(stream, map, mapsize, + buffer, bufsiz); + + if (status < Z_OK) + return status; + + /* Make sure we have the terminating NUL */ + if (!memchr(buffer, '\0', stream->next_out - (unsigned char *)buffer)) + return -1; + return 0; +} + static int unpack_sha1_header_to_strbuf(git_zstream *stream, unsigned char *map, unsigned long mapsize, void *buffer, unsigned long bufsiz, struct strbuf *header) { int status; - status = unpack_sha1_header(stream, map, mapsize, buffer, bufsiz); + status = unpack_sha1_short_header(stream, map, mapsize, buffer, bufsiz); + if (status < Z_OK) + return -1; /* * Check if entire header is unpacked in the first iteration. @@ -1682,6 +1702,8 @@ static int parse_sha1_header_extended(const char *hdr, struct object_info *oi, */ for (;;) { char c = *hdr++; + if (!c) + return -1; if (c == ' ') break; type_len++; |