read_object_with_reference: don't read beyond the buffer
Signed-off-by: Martin Koegler <mkoegler@auto.tuwien.ac.at> Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
parent
e5fc9a0aea
commit
50974ec994
@ -1943,7 +1943,8 @@ void *read_object_with_reference(const unsigned char *sha1,
|
||||
}
|
||||
ref_length = strlen(ref_type);
|
||||
|
||||
if (memcmp(buffer, ref_type, ref_length) ||
|
||||
if (ref_length + 40 > isize ||
|
||||
memcmp(buffer, ref_type, ref_length) ||
|
||||
get_sha1_hex((char *) buffer + ref_length, actual_sha1)) {
|
||||
free(buffer);
|
||||
return NULL;
|
||||
|
Loading…
Reference in New Issue
Block a user