fetch-pack: check for valid commit from server
A malicious server can return ACK with non-existent SHA-1 or not a commit. lookup_commit() in this case may return NULL. Do not let fetch-pack crash by accessing NULL address in this case. Signed-off-by: Nguyễn Thái Ngọc Duy <pclouds@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Nguyễn Thái Ngọc Duy committed
Aug 18, 2011 at 20:36 UTC
ec099546a9afdb73b6bf39d5d684e6fb207e2a7f
1 file changed
+2
builtin/fetch-pack.c
+2
@@ -395,6 +395,8 @@ static int find_common(int fd[2], unsigned char *result_sha1,
395
case ACK_continue: {
396
struct commit *commit =
397
lookup_commit(result_sha1);
398
+ if (!commit)
399
+ die("invalid commit %s", sha1_to_hex(result_sha1));
400
if (args.stateless_rpc
401
&& ack == ACK_common
402
&& !(commit->object.flags & COMMON)) {