receive-pack: do not overallocate command structure

An "update" command in the protocol exchange consists of 40-hex old
object name, SP, 40-hex new object name, SP, and a refname, but the
first instance is further followed by a NUL with feature requests.

The command structure, which has a flex-array member that stores the
refname at the end, was allocated based on the whole length of the
update command, without excluding the trailing feature requests.

Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/builtin/receive-pack.c b/builtin/receive-pack.c
index f93ac454b4133f5c1e7cb1675a618b4c0b3174cd..1663bebaa27d869c04e8d7638de07cc443605d78 100644 (file)
--- a/builtin/receive-pack.c
+++ b/builtin/receive-pack.c
@@ -872,10 +872,11 @@ static struct command *read_head_info(struct sha1_array *shallow)
                        if (parse_feature_request(feature_list, "quiet"))
                                quiet = 1;
                }
-               cmd = xcalloc(1, sizeof(struct command) + len - 80);
+               cmd = xcalloc(1, sizeof(struct command) + reflen + 1);
                hashcpy(cmd->old_sha1, old_sha1);
                hashcpy(cmd->new_sha1, new_sha1);
-               memcpy(cmd->ref_name, line + 82, len - 81);
+               memcpy(cmd->ref_name, refname, reflen);
+               cmd->ref_name[reflen] = '\0';
                *p = cmd;
                p = &cmd->next;
        }