reftable: fix OOB stack write in print functions

[thirdparty/git.git] / streaming.c

diff --git a/streaming.c b/streaming.c
index 5f480ad50c415cc48a591adb29b46f00b67468d7..fe54665d86e72a3400a6f60f610a5264bc0f0667 100644 (file)
--- a/streaming.c
+++ b/streaming.c
@@ -223,19 +223,24 @@ static int open_istream_loose(struct git_istream *st, struct repository *r,
                              const struct object_id *oid,
                              enum object_type *type)
 {
+       struct object_info oi = OBJECT_INFO_INIT;
+       oi.sizep = &st->size;
+       oi.typep = type;
+
        st->u.loose.mapped = map_loose_object(r, oid, &st->u.loose.mapsize);
        if (!st->u.loose.mapped)
                return -1;
-       if ((unpack_loose_header(&st->z,
-                                st->u.loose.mapped,
-                                st->u.loose.mapsize,
-                                st->u.loose.hdr,
-                                sizeof(st->u.loose.hdr)) < 0) ||
-           (parse_loose_header(st->u.loose.hdr, &st->size) < 0)) {
-               git_inflate_end(&st->z);
-               munmap(st->u.loose.mapped, st->u.loose.mapsize);
-               return -1;
+       switch (unpack_loose_header(&st->z, st->u.loose.mapped,
+                                   st->u.loose.mapsize, st->u.loose.hdr,
+                                   sizeof(st->u.loose.hdr), NULL)) {
+       case ULHR_OK:
+               break;
+       case ULHR_BAD:
+       case ULHR_TOO_LONG:
+               goto error;
        }
+       if (parse_loose_header(st->u.loose.hdr, &oi) < 0 || *type < 0)
+               goto error;
 
        st->u.loose.hdr_used = strlen(st->u.loose.hdr) + 1;
        st->u.loose.hdr_avail = st->z.total_out;
@@ -244,6 +249,10 @@ static int open_istream_loose(struct git_istream *st, struct repository *r,
        st->read = read_istream_loose;
 
        return 0;
+error:
+       git_inflate_end(&st->z);
+       munmap(st->u.loose.mapped, st->u.loose.mapsize);
+       return -1;
 }