parse_tag_buffer: don't parse invalid tags
The current tag parsing code can access memory outside the tag buffer, if \n are missing. This patch prevent this behaviour. Signed-off-by: Martin Koegler <mkoegler@auto.tuwien.ac.at> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Martin Koegler committed
Jan 6, 2008 at 20:03 UTC
a0393ef67679ea7720290bd45d9d628920df59f3
1 file changed
+3
-2
tag.c
+3
-2
@@ -39,6 +39,7 @@ int parse_tag_buffer(struct tag *item, void *data, unsigned long size)
39
unsigned char sha1[20];
40
const char *type_line, *tag_line, *sig_line;
41
char type[20];
42
+ const char *start = data;
43
44
if (item->object.parsed)
45
return 0;
@@ -53,11 +54,11 @@ int parse_tag_buffer(struct tag *item, void *data, unsigned long size)
54
if (memcmp("\ntype ", type_line-1, 6))
55
return -1;
56
56
- tag_line = strchr(type_line, '\n');
57
+ tag_line = memchr(type_line, '\n', size - (type_line - start));
58
if (!tag_line || memcmp("tag ", ++tag_line, 4))
59
return -1;
60
60
- sig_line = strchr(tag_line, '\n');
61
+ sig_line = memchr(tag_line, '\n', size - (tag_line - start));
62
if (!sig_line)
63
return -1;
64
sig_line++;