From: Jeff King Date: Fri, 5 Apr 2019 18:13:10 +0000 (-0400) Subject: server-info: fix blind pointer arithmetic X-Git-Tag: v2.22.0-rc0~70^2~5 X-Git-Url: https://git.lorimer.id.au/gitweb.git/diff_plain/b83a3089b584f622054e85b9bacbd18014259b7c?hp=b83a3089b584f622054e85b9bacbd18014259b7c server-info: fix blind pointer arithmetic When we're writing out a new objects/info/packs file, we read back the old one to try to keep the ordering the same. When we see a line starting with "P", we expect "P pack-1234..." and blindly jump to "line + 2" to parse the pack name. If we saw a line with _just_ "P" and nothing else, we'd jump past the end of the buffer and start reading arbitrary memory. This shouldn't be a big attack vector, as the files are local to the repository and written by us, but it's clearly worth fixing (we do read remote copies of the file for dumb-http fetches, but using a totally different parser!). Let's instead use skip_prefix() here, which avoids pointer arithmetic altogether. Note that this converts our switch statement to an if/else chain, making it slightly more verbose. But it will also make it easier to do a few follow-on cleanups. Signed-off-by: Jeff King Signed-off-by: Junio C Hamano ---