@@ -325,7 +325,7 @@ static int unescape_line(
325325 return 0 ;
326326}
327327
328- static int parse_multiline_variable (git_config_parser * reader , git_str * value , int in_quotes )
328+ static int parse_multiline_variable (git_config_parser * reader , git_str * value , int in_quotes , size_t * line_len )
329329{
330330 int quote_count ;
331331 bool multiline = true;
@@ -338,6 +338,10 @@ static int parse_multiline_variable(git_config_parser *reader, git_str *value, i
338338 git_parse_advance_line (& reader -> ctx );
339339 line = git__strndup (reader -> ctx .line , reader -> ctx .line_len );
340340 GIT_ERROR_CHECK_ALLOC (line );
341+ if (GIT_ADD_SIZET_OVERFLOW (line_len , * line_len , reader -> ctx .line_len )) {
342+ error = -1 ;
343+ goto out ;
344+ }
341345
342346 /*
343347 * We've reached the end of the file, there is no continuation.
@@ -415,7 +419,7 @@ static int parse_name(
415419 return 0 ;
416420}
417421
418- static int parse_variable (git_config_parser * reader , char * * var_name , char * * var_value )
422+ static int parse_variable (git_config_parser * reader , char * * var_name , char * * var_value , size_t * line_len )
419423{
420424 const char * value_start = NULL ;
421425 char * line = NULL , * name = NULL , * value = NULL ;
@@ -449,7 +453,7 @@ static int parse_variable(git_config_parser *reader, char **var_name, char **var
449453 git_str_attach (& multi_value , value , 0 );
450454 value = NULL ;
451455
452- if (parse_multiline_variable (reader , & multi_value , quote_count % 2 ) < 0 ||
456+ if (parse_multiline_variable (reader , & multi_value , quote_count % 2 , line_len ) < 0 ||
453457 git_str_oom (& multi_value )) {
454458 error = -1 ;
455459 git_str_dispose (& multi_value );
@@ -554,7 +558,7 @@ int git_config_parse(
554558 break ;
555559
556560 default : /* assume variable declaration */
557- if ((result = parse_variable (parser , & var_name , & var_value )) == 0 && on_variable ) {
561+ if ((result = parse_variable (parser , & var_name , & var_value , & line_len )) == 0 && on_variable ) {
558562 result = on_variable (parser , current_section , var_name , var_value , line_start , line_len , payload );
559563 git__free (var_name );
560564 git__free (var_value );
0 commit comments