diff options
author | Jeff King <peff@peff.net> | 2014-06-18 15:47:17 -0400 |
---|---|---|
committer | Junio C Hamano <gitster@pobox.com> | 2014-06-20 10:44:44 -0700 |
commit | 21a2d4ada52132e6b0b67f8e28aa4bcda416f7f2 (patch) | |
tree | e2a100df98e339beba257ad7254a15a16b51f848 /fast-import.c | |
parent | fast-import: fix read of uninitialized argv memory (diff) | |
download | tgif-21a2d4ada52132e6b0b67f8e28aa4bcda416f7f2.tar.xz |
transport-helper: avoid reading past end-of-string
We detect the "import-marks" capability by looking for that
string, but _without_ a trailing space. Then we skip past it
using strlen("import-marks "), with a space. So if a remote
helper gives us exactly "import-marks", we will read past
the end-of-string by one character.
This is unlikely to be a problem in practice, because such
input is malformed in the first place, and because there is
a good chance that the string has an extra NUL terminator
one character after the original (because it formerly had a
newline in it that we parsed off).
We can fix it by using skip_prefix with "import-marks ",
with the space. The other form appears to be a typo from
a515ebe (transport-helper: implement marks location as
capability, 2011-07-16); "import-marks" has never existed
without an argument, and it should match the "export-marks"
definition above.
Speaking of which, we can also use skip_prefix in a few
other places while we are in the function.
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 'fast-import.c')
0 files changed, 0 insertions, 0 deletions