read_object_with_reference: don't read beyond the buffer
Signed-off-by: Martin Koegler <mkoegler@auto.tuwien.ac.at> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Martin Koegler committed
Feb 18, 2008 at 21:47 UTC
50974ec99408b2d814360863e72a5eca613889c8
1 file changed
+2
-1
sha1_file.c
+2
-1
@@ -1943,7 +1943,8 @@ void *read_object_with_reference(const unsigned char *sha1,
1943
}
1944
ref_length = strlen(ref_type);
1945
1946
- if (memcmp(buffer, ref_type, ref_length) ||
1946
+ if (ref_length + 40 > isize ||
1947
+ memcmp(buffer, ref_type, ref_length) ||
1948
get_sha1_hex((char *) buffer + ref_length, actual_sha1)) {
1949
free(buffer);
1950
return NULL;