From 1dd348b8a357e1d69ccb9f853e983c8fd312b9c5 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Wed, 15 Jul 2026 12:38:41 -1000 Subject: Avoid an out-of-bounds read on short scan paths A relative path shorter than five bytes made the `/.git` suffix test read before the buffer. --- source/scan-tree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'source/scan-tree.c') diff --git a/source/scan-tree.c b/source/scan-tree.c index c120efe..8e3fe30 100644 --- a/source/scan-tree.c +++ b/source/scan-tree.c @@ -115,7 +115,7 @@ static void add_repo(const char *base, struct strbuf *path) else strbuf_addstr(&rel, path->buf + strlen(base) + 1); - if (!strcmp(rel.buf + rel.len - 5, "/.git")) + if (rel.len >= 5 && !strcmp(rel.buf + rel.len - 5, "/.git")) strbuf_setlen(&rel, rel.len - 5); else if (rel.len && rel.buf[rel.len - 1] == '/') strbuf_setlen(&rel, rel.len - 1); -- cgit v2.8.0