Skip to content

Commit 5fabaca

Browse files
committed
smart_pkt: fix buffer overflow when parsing "unpack" packets
When checking whether an "unpack" packet returned the "ok" status or not, we use a call to `git__prefixcmp`. In case where the passed line isn't properly NUL terminated, though, this may overrun the line buffer. Fix this by using `git__prefixncmp` instead.
1 parent b5ba7af commit 5fabaca

File tree

1 file changed

+2
-4
lines changed

1 file changed

+2
-4
lines changed

src/transports/smart_pkt.c

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -350,13 +350,11 @@ static int unpack_pkt(git_pkt **out, const char *line, size_t len)
350350
{
351351
git_pkt_unpack *pkt;
352352

353-
GIT_UNUSED(len);
354-
355353
pkt = git__malloc(sizeof(*pkt));
356354
GITERR_CHECK_ALLOC(pkt);
357-
358355
pkt->type = GIT_PKT_UNPACK;
359-
if (!git__prefixcmp(line, "unpack ok"))
356+
357+
if (!git__prefixncmp(line, len, "unpack ok"))
360358
pkt->unpack_ok = 1;
361359
else
362360
pkt->unpack_ok = 0;

0 commit comments

Comments
 (0)