summaryrefslogtreecommitdiff
path: root/t/lib-git-daemon.sh
diff options
context:
space:
mode:
authorLibravatar Jeff King <peff@peff.net>2017-03-13 10:04:45 -0400
committerLibravatar Junio C Hamano <gitster@pobox.com>2017-03-13 10:20:29 -0700
commitd61434ae813cc86a1a87d05cc61e36e87b0e20a9 (patch)
tree83b452df8faf0dda505a231abe267a89de1a32d3 /t/lib-git-daemon.sh
parentGit 2.12 (diff)
downloadtgif-d61434ae813cc86a1a87d05cc61e36e87b0e20a9.tar.xz
http-walker: fix buffer underflow processing remote alternates
If we parse a remote alternates (or http-alternates), we expect relative lines like: ../../foo.git/objects which we convert into "$URL/../foo.git/" (and then use that as a base for fetching more objects). But if the remote feeds us nonsense like just: ../ we will try to blindly strip the last 7 characters, assuming they contain the string "objects". Since we don't _have_ 7 characters at all, this results in feeding a small negative value to strbuf_add(), which converts it to a size_t, resulting in a big positive value. This should consistently fail (since we can't generall allocate the max size_t minus 7 bytes), so there shouldn't be any security implications. Let's fix this by using strbuf_strip_suffix() to drop the characters we want. If they're not present, we'll ignore the alternate (in theory we could use it as-is, but the rest of the http-walker code unconditionally tacks "objects/" back on, so it is it not prepared to handle such a case). Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 't/lib-git-daemon.sh')
0 files changed, 0 insertions, 0 deletions