parse_tag_buffer(): do not prefixcmp() out of range
There is a check (size < 64) at the beginning of the function, but that only covers object+type lines. Signed-off-by: Nguyễn Thái Ngọc Duy <pclouds@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Nguyễn Thái Ngọc Duy committed
Feb 14, 2011 at 20:02 UTC
855942528e892cff3cadb4eb1c4cf1d2a7cd83de
1 file changed
+4
-2
tag.c
+4
-2
@@ -97,7 +97,9 @@ int parse_tag_buffer(struct tag *item, const void *data, unsigned long size)
97
item->tagged = NULL;
98
}
99
100
- if (prefixcmp(bufptr, "tag "))
100
+ if (bufptr + 4 < tail && !prefixcmp(bufptr, "tag "))
101
+ ; /* good */
102
+ else
103
return -1;
104
bufptr += 4;
105
nl = memchr(bufptr, '\n', tail - bufptr);
@@ -106,7 +108,7 @@ int parse_tag_buffer(struct tag *item, const void *data, unsigned long size)
108
item->tag = xmemdupz(bufptr, nl - bufptr);
109
bufptr = nl + 1;
110
109
- if (!prefixcmp(bufptr, "tagger "))
111
+ if (bufptr + 7 < tail && !prefixcmp(bufptr, "tagger "))
112
item->date = parse_tag_date(bufptr, tail);
113
else
114
item->date = 0;