commit 32596e16badddcbd6c032b6367d125df0e421f4b
from: Stefan Sperling <stsp@stsp.name>
date: Thu Jul 23 14:21:28 2020 UTC

fix got_tree_entry_get_symlink_target() in case of multiple loop iterations

commit - f8f7c882a202ae17391b28587d013b5dd2809366
commit + 32596e16badddcbd6c032b6367d125df0e421f4b
blob - 525bbd9c114f16ca9bebf27cbc60e52a82311bc4
blob + cfc0d4b524be60277183c28685d392dbde650020
--- lib/object.c
+++ lib/object.c
@@ -869,7 +869,7 @@ got_tree_entry_get_symlink_target(char **link_target, 
 {
 	const struct got_error *err = NULL;
 	struct got_blob_object *blob = NULL;
-	size_t len, totlen, hdrlen;
+	size_t len, totlen, hdrlen, offset;
 
 	*link_target = NULL;
 
@@ -882,6 +882,7 @@ got_tree_entry_get_symlink_target(char **link_target, 
 		return err;
 	hdrlen = got_object_blob_get_hdrlen(blob);
 	totlen = 0;
+	offset = 0;
 	do {
 		char *p;
 
@@ -900,9 +901,10 @@ got_tree_entry_get_symlink_target(char **link_target, 
 		}
 		*link_target = p;
 		/* Skip blob object header first time around. */
-		memcpy(*link_target,
+		memcpy(*link_target + offset,
 		    got_object_blob_get_read_buf(blob) + hdrlen, len - hdrlen);
 		hdrlen = 0;
+		offset = totlen;
 	} while (len > 0);
 	(*link_target)[totlen] = '\0';
 done: