Bound the search and cache key a request can ask

1 file changed, 8 insertions, 1 deletion

diff --git a/source/cgit.c b/source/cgit.c
index 2ecfb4f..7cce3d3 100644
--- a/source/cgit.c
+++ b/source/cgit.c
@@ -360,7 +360,14 @@ static void querystring_cb(const char *name, const char *value)
 	} else if (!strcmp(name, "qt")) {
 		ctx.qry.grep = xstrdup(value);
 	} else if (!strcmp(name, "q")) {
-		ctx.qry.search = xstrdup(value);
+		/* A query is matched against every repository, ref or commit
+		 * the page lists, so bound what one request can ask to be
+		 * compared. Nothing legible reaches this length, and the value
+		 * also lands in the cache key. */
+		if (strlen(value) > CGIT_MAX_SEARCH_LEN)
+			ctx.qry.search = xstrndup(value, CGIT_MAX_SEARCH_LEN);
+		else
+			ctx.qry.search = xstrdup(value);
 	} else if (!strcmp(name, "h")) {
 		ctx.qry.head = xstrdup(value);
 		ctx.qry.has_symref = 1;