url: do not read past end of buffer
url_decode_internal could have been tricked into reading past the length of the **query buffer if there are fewer than 2 characters after a % (in a null-terminated string, % would have to be the last character). Prevent this from happening by checking len before decoding the % sequence. Helped-by: René Scharfe <l.s.r@web.de> Signed-off-by: Matthew DeVore <matvore@google.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Matthew DeVore committed
Jun 4, 2019 at 10:57 UTC
3f6b8a6177f3197ddad82a6da2ff9b4704664f5d
1 file changed
+1
-1
url.c
+1
-1
@@ -46,7 +46,7 @@ static char *url_decode_internal(const char **query, int len,
46
break;
47
}
48
49
- if (c == '%') {
49
+ if (c == '%' && (len < 0 || len >= 3)) {
50
int val = hex2chr(q + 1);
51
if (0 <= val) {
52
strbuf_addch(out, val);