Fix integer overflow in unpack_sha1_rest()

[jc: later NUL termination by the caller becomes unnecessary] Signed-off-by: Ilari Liusvaara <ilari.liusvaara@elisanet.fi> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Ilari Liusvaara committed Jan 26, 2010 at 20:24 UTC 3aee68aa68e80856de26340b707148d8f8d5b82e

1 file changed +1 -2

sha1_file.c

+1 -2

@@ -1232,7 +1232,7 @@ static int unpack_sha1_header(z_stream *stream, unsigned char *map, unsigned lon

1232 static void *unpack_sha1_rest(z_stream *stream, void *buffer, unsigned long size, const unsigned char *sha1)

1233 {

1234 int bytes = strlen(buffer) + 1;

1235 - unsigned char *buf = xmalloc(1+size);

1235 + unsigned char *buf = xmallocz(size);

1236 unsigned long n;

1237 int status = Z_OK;

1238

@@ -1260,7 +1260,6 @@ static void *unpack_sha1_rest(z_stream *stream, void *buffer, unsigned long size

1260 while (status == Z_OK)

1261 status = git_inflate(stream, Z_FINISH);

1262 }

1263 - buf[size] = 0;

1263 if (status == Z_STREAM_END && !stream->avail_in) {

1264 git_inflate_end(stream);

1265 return buf;