[PATCH] parse_tag_buffer: don't parse invalid tags
From: Martin Koegler <hidden>
Date: 2016-06-15 22:44:02
Subsystem:
the rest · Maintainer:
Linus Torvalds
The current tag parsing code can access memory outside the tag buffer, if \n are missing. This patch prevent this behaviour. Signed-off-by: Martin Koegler <redacted> --- tag.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/tag.c b/tag.c
index f62bcdd..fa22ae6 100644
--- a/tag.c
+++ b/tag.c@@ -39,6 +39,7 @@ int parse_tag_buffer(struct tag *item, void *data, unsigned long size) unsigned char sha1[20]; const char *type_line, *tag_line, *sig_line; char type[20]; + const char* start = data; if (item->object.parsed) return 0;
@@ -53,11 +54,11 @@ int parse_tag_buffer(struct tag *item, void *data, unsigned long size) if (memcmp("\ntype ", type_line-1, 6)) return -1; - tag_line = strchr(type_line, '\n'); + tag_line = memchr(type_line, '\n', size - (type_line - start)); if (!tag_line || memcmp("tag ", ++tag_line, 4)) return -1; - sig_line = strchr(tag_line, '\n'); + sig_line = memchr(tag_line, '\n', size - (tag_line - start)); if (!sig_line) return -1; sig_line++;
--
1.4.4.4