url: do not read past end of buffer

url_decode_internal could have been tricked into reading past the length of the **query buffer if there are fewer than 2 characters after a % (in a null-terminated string, % would have to be the last character). Prevent this from happening by checking len before decoding the % sequence. Helped-by: René Scharfe <l.s.r@web.de> Signed-off-by: Matthew DeVore <matvore@google.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Matthew DeVore committed Jun 4, 2019 at 10:57 UTC 3f6b8a6177f3197ddad82a6da2ff9b4704664f5d
1 file changed +1 -1
url.c
+1 -1
@@ -46,7 +46,7 @@ static char *url_decode_internal(const char **query, int len,
46 break;
47 }
48
49 - if (c == '%') {
49 + if (c == '%' && (len < 0 || len >= 3)) {
50 int val = hex2chr(q + 1);
51 if (0 <= val) {
52 strbuf_addch(out, val);