Merge remote-tracking branch 'origin/master' into no-pkt-pack

3 files changed, 41 insertions, 14 deletions

diff --git a/src/transports/smart.c b/src/transports/smart.c
index 79b5a3e6d..fdc9c116d 100644
--- a/src/transports/smart.c
+++ b/src/transports/smart.c
@@ -167,8 +167,10 @@ int git_smart__update_heads(transport_smart *t, git_vector *symrefs)
 			git_vector_foreach(symrefs, j, spec) {
 				git_buf_clear(&buf);
 				if (git_refspec_src_matches(spec, ref->head.name) &&
-				    !(error = git_refspec_transform(&buf, spec, ref->head.name)))
+				    !(error = git_refspec_transform(&buf, spec, ref->head.name))) {
+					git__free(ref->head.symref_target);
 					ref->head.symref_target = git_buf_detach(&buf);
+				}
 			}
 
 			git_buf_dispose(&buf);
@@ -266,14 +268,21 @@ static int git_smart__connect(
 	/* We now have loaded the refs. */
 	t->have_refs = 1;
 
-	first = (git_pkt_ref *)git_vector_get(&t->refs, 0);
+	pkt = (git_pkt *)git_vector_get(&t->refs, 0);
+	if (pkt && GIT_PKT_REF != pkt->type) {
+		giterr_set(GITERR_NET, "invalid response");
+		return -1;
+	}
+	first = (git_pkt_ref *)pkt;
 
 	if ((error = git_vector_init(&symrefs, 1, NULL)) < 0)
 		return error;
 
 	/* Detect capabilities */
-	if (git_smart__detect_caps(first, &t->caps, &symrefs) < 0)
+	if (git_smart__detect_caps(first, &t->caps, &symrefs) < 0) {
+		free_symrefs(&symrefs);
 		return -1;
+	}
 
 	/* If the only ref in the list is capabilities^{} with OID_ZERO, remove it */
 	if (1 == t->refs.length && !strcmp(first->head.name, "capabilities^{}") &&
diff --git a/src/transports/smart_pkt.c b/src/transports/smart_pkt.c
index 07701abcc..cd9ca6c92 100644
--- a/src/transports/smart_pkt.c
+++ b/src/transports/smart_pkt.c
@@ -203,6 +203,11 @@ static int ref_pkt(git_pkt **out, const char *line, size_t len)
 	git_pkt_ref *pkt;
 	size_t alloclen;
 
+	if (len < GIT_OID_HEXSZ + 1) {
+		giterr_set(GITERR_NET, "error parsing pkt-line");
+		return -1;
+	}
+
 	pkt = git__malloc(sizeof(git_pkt_ref));
 	GITERR_CHECK_ALLOC(pkt);
 
@@ -470,6 +475,9 @@ int git_pkt_parse_line(
 
 void git_pkt_free(git_pkt *pkt)
 {
+	if (pkt == NULL) {
+		return;
+	}
 	if (pkt->type == GIT_PKT_REF) {
 		git_pkt_ref *p = (git_pkt_ref *) pkt;
 		git__free(p->head.name);
diff --git a/src/transports/smart_protocol.c b/src/transports/smart_protocol.c
index 8a094b698..948b93bdd 100644
--- a/src/transports/smart_protocol.c
+++ b/src/transports/smart_protocol.c
@@ -70,6 +70,12 @@ int git_smart__store_refs(transport_smart *t, int flushes)
 			return -1;
 		}
 
+		if (pkt->type == GIT_PKT_PACK) {
+			giterr_set(GITERR_NET, "unexpected packfile");
+			git__free(pkt);
+			return -1;
+		}
+
 		if (pkt->type != GIT_PKT_FLUSH && git_vector_insert(refs, pkt) < 0)
 			return -1;
 
@@ -317,27 +323,30 @@ on_error:
 static int wait_while_ack(gitno_buffer *buf)
 {
 	int error;
-	git_pkt_ack *pkt = NULL;
+	git_pkt *pkt = NULL;
+	git_pkt_ack *ack = NULL;
 
 	while (1) {
-		git__free(pkt);
+		git_pkt_free(pkt);
 
-		if ((error = recv_pkt((git_pkt **)&pkt, NULL, buf)) < 0)
+		if ((error = recv_pkt(&pkt, NULL, buf)) < 0)
 			return error;
 
 		if (pkt->type == GIT_PKT_NAK)
 			break;
+		if (pkt->type != GIT_PKT_ACK)
+			continue;
 
-		if (pkt->type == GIT_PKT_ACK &&
-		    (pkt->status != GIT_ACK_CONTINUE &&
-		     pkt->status != GIT_ACK_COMMON &&
-		     pkt->status != GIT_ACK_READY)) {
-			git__free(pkt);
-			return 0;
+		ack = (git_pkt_ack*)pkt;
+
+		if (ack->status != GIT_ACK_CONTINUE &&
+		    ack->status != GIT_ACK_COMMON &&
+		    ack->status != GIT_ACK_READY) {
+			break;
 		}
 	}
 
-	git__free(pkt);
+	git_pkt_free(pkt);
 	return 0;
 }
 
@@ -615,7 +624,8 @@ int git_smart__download_pack(
 			}
 		}
 
-		git__free(pkt);
+		git_pkt_free(pkt);
+
 		if (error < 0)
 			goto done;