[PATCH] remote-curl: Add a format check to parsing of info/refs
From: Julian Phillips <hidden>
Date: 2016-06-15 22:51:36
Subsystem:
the rest · Maintainer:
Linus Torvalds
From: Julian Phillips <hidden>
Date: 2016-06-15 22:51:36
Subsystem:
the rest · Maintainer:
Linus Torvalds
When parsing info/refs, no checks were applied that the file was in the requried format. Since the file is read from a remote webserver, this isn't guarenteed to be true. Add a check that the file at least only contains lines that consist of 40 characters followed by a tab and then the ref name. Signed-off-by: Julian Phillips <redacted> --- If you happen to try, for example, git ls-remote http://example.com/foo, when http://example.com/foo/info/refs exists - but isn't part of a git repository you get a very strange response as remote-curl.c attempts to parse refs out of the file. This may be an unlikely situtation, but that doesn't mean it can't be hanlded a little better. Julian remote-curl.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/remote-curl.c b/remote-curl.c
index b5be25c..8ac5028 100644
--- a/remote-curl.c
+++ b/remote-curl.c@@ -227,6 +227,8 @@ static struct ref *parse_info_refs(struct discovery *heads) if (data[i] == '\t') mid = &data[i]; if (data[i] == '\n') { + if (mid - start != 40) + die("%sinfo/refs not valid: is this a git repository?", url); data[i] = 0; ref_name = mid + 1; ref = xmalloc(sizeof(struct ref) +
--
1.7.6