diff options
| author | Carlos Martín Nieto <carlosmn@github.com> | 2016-03-22 01:54:49 -0700 |
|---|---|---|
| committer | Carlos Martín Nieto <carlosmn@github.com> | 2016-03-22 01:54:49 -0700 |
| commit | e50a49ee9b0fa536afc4dd87ee19197a53bd78cd (patch) | |
| tree | 007ce98bdc24ac358765f989919b3881509c61c0 /src | |
| parent | cec320fe874805b4af3ac14db3cfe6086e54c760 (diff) | |
| parent | b3eb2cde2bf6cf1011324eb594087b7c93a02a41 (diff) | |
| download | libgit2-e50a49ee9b0fa536afc4dd87ee19197a53bd78cd.tar.gz | |
Merge pull request #3559 from yongthecoder/master
Add a sanity check in git_indexer_commit to avoid subtraction overflow.
Diffstat (limited to 'src')
| -rw-r--r-- | src/indexer.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/src/indexer.c b/src/indexer.c index 1ffbc2790..ce039257d 100644 --- a/src/indexer.c +++ b/src/indexer.c @@ -914,12 +914,17 @@ int git_indexer_commit(git_indexer *idx, git_transfer_progress *stats) git_filebuf index_file = {0}; void *packfile_trailer; + if (!idx->parsed_header) { + giterr_set(GITERR_INDEXER, "incomplete pack header"); + return -1; + } + if (git_hash_ctx_init(&ctx) < 0) return -1; /* Test for this before resolve_deltas(), as it plays with idx->off */ - if (idx->off < idx->pack->mwf.size - 20) { - giterr_set(GITERR_INDEXER, "Unexpected data at the end of the pack"); + if (idx->off + 20 < idx->pack->mwf.size) { + giterr_set(GITERR_INDEXER, "unexpected data at the end of the pack"); return -1; } |