pkt-line: add size parameter to packet_length()

hex2chr() takes care not to run over the end of a NUL-terminated string.
It's used in packet_length(), but both callers of that function pass a
four-byte buffer, making NUL-checks unnecessary.  packet_length() could
accidentally be used with a pointer to a buffer of unknown size at new
call-sites, though, and the compiler wouldn't complain.

Add a size parameter plus check, and remove the NUL-checks by calling
hexval() directly.  This trades three NUL checks against one size check
and the ability to report the use of a short buffer at runtime.

If any of the four bytes is NUL or -- more generally -- not a
hexadecimal digit, then packet_length() still returns a negative value.

Signed-off-by: René Scharfe <l.s.r@web.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/pkt-line.c b/pkt-line.c
index 62b4208b66e15d72257f5a2b72f4fa6ce3684376..fcfa357ccd1567b5542385c338f35810950849b5 100644 (file)
--- a/pkt-line.c
+++ b/pkt-line.c
@@ -373,10 +373,14 @@ static int get_packet_data(int fd, char **src_buf, size_t *src_size,
        return ret;
 }
 
-int packet_length(const char lenbuf_hex[4])
+int packet_length(const char lenbuf_hex[4], size_t size)
 {
-       int val = hex2chr(lenbuf_hex);
-       return (val < 0) ? val : (val << 8) | hex2chr(lenbuf_hex + 2);
+       if (size < 4)
+               BUG("buffer too small");
+       return  hexval(lenbuf_hex[0]) << 12 |
+               hexval(lenbuf_hex[1]) <<  8 |
+               hexval(lenbuf_hex[2]) <<  4 |
+               hexval(lenbuf_hex[3]);
 }
 
 static char *find_packfile_uri_path(const char *buffer)
@@ -419,7 +423,7 @@ enum packet_read_status packet_read_with_status(int fd, char **src_buffer,
                return PACKET_READ_EOF;
        }
 
-       len = packet_length(linelen);
+       len = packet_length(linelen, sizeof(linelen));
 
        if (len < 0) {
                if (options & PACKET_READ_GENTLE_ON_READ_ERROR)

diff --git a/pkt-line.h b/pkt-line.h
index 7c23a4bfaf740312c09f25a84eed7bedda35de4d..954eec87197d3e0c50812879d47e0afbb008baa3 100644 (file)
--- a/pkt-line.h
+++ b/pkt-line.h
@@ -94,7 +94,7 @@ int packet_read(int fd, char *buffer, unsigned size, int options);
  * If lenbuf_hex contains non-hex characters, return -1. Otherwise, return the
  * numeric value of the length header.
  */
-int packet_length(const char lenbuf_hex[4]);
+int packet_length(const char lenbuf_hex[4], size_t size);
 
 /*
  * Read a packetized line into a buffer like the 'packet_read()' function but

diff --git a/remote-curl.c b/remote-curl.c
index acf7b2bb40ac4edc07e98934a51c4d69711bc6cb..143318658e610e5277ccae7d8afd1eecc54ea15b 100644 (file)
--- a/remote-curl.c
+++ b/remote-curl.c
@@ -763,7 +763,8 @@ static void check_pktline(struct check_pktline_state *state, const char *ptr, si
                        size -= digits_remaining;
 
                        if (state->len_filled == 4) {
-                               state->remaining = packet_length(state->len_buf);
+                               state->remaining = packet_length(state->len_buf,
+                                                                sizeof(state->len_buf));
                                if (state->remaining < 0) {
                                        die(_("remote-curl: bad line length character: %.4s"), state->len_buf);
                                } else if (state->remaining == 2) {