commit 4793d91bf3b955dcc0dab2308ff9ebea06504de3 from: Stefan Sperling date: Sun Sep 22 13:16:33 2019 UTC have got_object_parse_* check for zero-length input commit - 6ced7ba8b0a1cecd667313e4e45f51be404f97c8 commit + 4793d91bf3b955dcc0dab2308ff9ebea06504de3 blob - 8a9418989e78b84876e0c489d374e0d53cf917e7 blob + b6cd712c154536cdfbd3c4dec1d9f014e4630378 --- lib/object_parse.c +++ lib/object_parse.c @@ -494,6 +494,9 @@ got_object_parse_commit(struct got_commit_object **com char *s = buf; size_t label_len; ssize_t remain = (ssize_t)len; + + if (remain == 0) + return got_error(GOT_ERR_BAD_OBJ_DATA); *commit = got_object_commit_alloc_partial(); if (*commit == NULL) @@ -724,6 +727,9 @@ got_object_parse_tree(struct got_tree_object **tree, u TAILQ_INIT(&pathlist); + if (remain == 0) + return got_error(GOT_ERR_BAD_OBJ_DATA); + *tree = calloc(1, sizeof(**tree)); if (*tree == NULL) return got_error_from_errno("calloc"); @@ -788,6 +794,9 @@ got_object_parse_tag(struct got_tag_object **tag, uint size_t remain = len; char *s = buf; size_t label_len; + + if (remain == 0) + return got_error(GOT_ERR_BAD_OBJ_DATA); *tag = calloc(1, sizeof(**tag)); if (*tag == NULL)