Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Avoid an out-of-bounds read on short scan paths
A relative path shorter than five bytes made the /.git suffix test read
before the buffer.
| -rw-r--r-- | source/scan-tree.c | 2 |
1 file changed, 1 insertion, 1 deletion
diff --git a/source/scan-tree.c b/source/scan-tree.c index c120efe..8e3fe30 100644 --- a/source/scan-tree.c +++ b/source/scan-tree.c @@ -115,7 +115,7 @@ static void add_repo(const char *base, struct strbuf *path) else strbuf_addstr(&rel, path->buf + strlen(base) + 1); - if (!strcmp(rel.buf + rel.len - 5, "/.git")) + if (rel.len >= 5 && !strcmp(rel.buf + rel.len - 5, "/.git")) strbuf_setlen(&rel, rel.len - 5); else if (rel.len && rel.buf[rel.len - 1] == '/') strbuf_setlen(&rel, rel.len - 1); |