From: Nguyễn Thái Ngọc Duy <pclouds@gmail.com>
Date: Mon, 14 Feb 2011 13:02:51 +0000 (+0700)
Subject: parse_tag_buffer(): do not prefixcmp() out of range
X-Git-Tag: v1.7.4.2~53
X-Git-Url: https://git.lorimer.id.au/gitweb.git/diff_plain/855942528e892cff3cadb4eb1c4cf1d2a7cd83de?ds=inline;hp=--cc

parse_tag_buffer(): do not prefixcmp() out of range

There is a check (size < 64) at the beginning of the function, but
that only covers object+type lines.

Signed-off-by: Nguyễn Thái Ngọc Duy <pclouds@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
---

855942528e892cff3cadb4eb1c4cf1d2a7cd83de
diff --git a/tag.c b/tag.c
index ecf7c1e9ce..7d38cc0f4d 100644
--- a/tag.c
+++ b/tag.c
@@ -97,7 +97,9 @@ int parse_tag_buffer(struct tag *item, const void *data, unsigned long size)
 		item->tagged = NULL;
 	}
 
-	if (prefixcmp(bufptr, "tag "))
+	if (bufptr + 4 < tail && !prefixcmp(bufptr, "tag "))
+		; 		/* good */
+	else
 		return -1;
 	bufptr += 4;
 	nl = memchr(bufptr, '\n', tail - bufptr);
@@ -106,7 +108,7 @@ int parse_tag_buffer(struct tag *item, const void *data, unsigned long size)
 	item->tag = xmemdupz(bufptr, nl - bufptr);
 	bufptr = nl + 1;
 
-	if (!prefixcmp(bufptr, "tagger "))
+	if (bufptr + 7 < tail && !prefixcmp(bufptr, "tagger "))
 		item->date = parse_tag_date(bufptr, tail);
 	else
 		item->date = 0;