From f2214dede950e506d7637744599ef27b149bbda1 Mon Sep 17 00:00:00 2001 From: "brian m. carlson" Date: Sun, 26 Mar 2017 16:01:28 +0000 Subject: [PATCH] builtin/receive-pack: fix incorrect pointer arithmetic If we had already processed the last newline in a push certificate, we would end up subtracting NULL from the end-of-certificate pointer when computing the length of the line. This would have resulted in an absurdly large length, and possibly a buffer overflow. Instead, subtract the beginning-of-certificate pointer from the end-of-certificate pointer, which is what's expected. Note that this situation should never occur, since not only do we require the certificate to be newline terminated, but the signature will only be read from the beginning of a line. Nevertheless, it seems prudent to correct it. Signed-off-by: brian m. carlson Signed-off-by: Junio C Hamano --- builtin/receive-pack.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/builtin/receive-pack.c b/builtin/receive-pack.c index 42f25a5103..df18eac9e4 100644 --- a/builtin/receive-pack.c +++ b/builtin/receive-pack.c @@ -1127,7 +1127,7 @@ static void queue_commands_from_cert(struct command **tail, while (boc < eoc) { const char *eol = memchr(boc, '\n', eoc - boc); - tail = queue_command(tail, boc, eol ? eol - boc : eoc - eol); + tail = queue_command(tail, boc, eol ? eol - boc : eoc - boc); boc = eol ? eol + 1 : eoc; } } -- 2.47.1