Merge branch 'bc/push-cert-receive-fix'

gitster · gitster · commit e711824c5ec4 · 2017-03-30T14:07:18.000-07:00
"git receive-pack" could have been forced to die by attempting
allocate an unreasonably large amount of memory with a crafted push
certificate; this has been fixed.

* bc/push-cert-receive-fix:
  builtin/receive-pack: fix incorrect pointer arithmetic
diff --git a/builtin/receive-pack.c b/builtin/receive-pack.c
@@ -1524,7 +1524,7 @@ static void queue_commands_from_cert(struct command **tail,
 
 	while (boc < eoc) {
 		const char *eol = memchr(boc, '\n', eoc - boc);
-		tail = queue_command(tail, boc, eol ? eol - boc : eoc - eol);
+		tail = queue_command(tail, boc, eol ? eol - boc : eoc - boc);
 		boc = eol ? eol + 1 : eoc;
 	}
 }

Original file line number	Diff line number	Diff line change
`@@ -1524,7 +1524,7 @@ static void queue_commands_from_cert(struct command **tail,`
`1524`	`1524`
`1525`	`1525`	`while (boc < eoc) {`
`1526`	`1526`	`const char *eol = memchr(boc, '\n', eoc - boc);`
`1527`		`- tail = queue_command(tail, boc, eol ? eol - boc : eoc - eol);`
	`1527`	`+ tail = queue_command(tail, boc, eol ? eol - boc : eoc - boc);`
`1528`	`1528`	`boc = eol ? eol + 1 : eoc;`
`1529`	`1529`	`}`
`1530`	`1530`	`}`