There are two different buffer overflows present when parsing "ok" packets. First, we never verify whether the line already ends after "ok", but directly go ahead and also try to skip the expected space after "ok". Second, we then go ahead and use `strchr` to scan for the terminating newline character. But in case where the line isn't terminated correctly, this can overflow the line buffer. Fix the issues by using `git__prefixncmp` to check for the "ok " prefix and only checking for a trailing '\n' instead of using `memchr`. This also fixes the issue of us always requiring a trailing '\n'. Reported by oss-fuzz, issue 9749: Crash Type: Heap-buffer-overflow READ {*} Crash Address: 0x6310000389c0 Crash State: ok_pkt git_pkt_parse_line git_smart__store_refs Sanitizer: address (ASAN) (cherry picked from commit a9f1ca09)
Name |
Last commit
|
Last update |
---|---|---|
.github | Loading commit data... | |
cmake/Modules | Loading commit data... | |
deps | Loading commit data... | |
docs | Loading commit data... | |
examples | Loading commit data... | |
include | Loading commit data... | |
script | Loading commit data... | |
src | Loading commit data... | |
tests | Loading commit data... | |
.HEADER | Loading commit data... | |
.editorconfig | Loading commit data... | |
.gitattributes | Loading commit data... | |
.gitignore | Loading commit data... | |
.mailmap | Loading commit data... | |
.travis.yml | Loading commit data... | |
AUTHORS | Loading commit data... | |
CHANGELOG.md | Loading commit data... | |
CMakeLists.txt | Loading commit data... | |
CODE_OF_CONDUCT.md | Loading commit data... | |
CONTRIBUTING.md | Loading commit data... | |
CONVENTIONS.md | Loading commit data... | |
COPYING | Loading commit data... | |
PROJECTS.md | Loading commit data... | |
README.md | Loading commit data... | |
THREADING.md | Loading commit data... | |
api.docurium | Loading commit data... | |
appveyor.yml | Loading commit data... | |
git.git-authors | Loading commit data... | |
libgit2.pc.in | Loading commit data... | |
libgit2_clar.supp | Loading commit data... |