diff options
| author | Patrick Steinhardt <ps@pks.im> | 2018-03-08 12:36:46 +0000 |
|---|---|---|
| committer | Patrick Steinhardt <ps@pks.im> | 2018-03-10 10:24:18 +0000 |
| commit | 3db1af1f370295ad5355b8f64b865a2a357bcac0 (patch) | |
| tree | 190b1aa43dcdd197ef1ade1d886fb6870b22a829 /include/git2 | |
| parent | 3207ddb0103543da8ad2139ec6539f590f9900c1 (diff) | |
| download | libgit2-3db1af1f370295ad5355b8f64b865a2a357bcac0.tar.gz | |
index: error out on unreasonable prefix-compressed path lengths
When computing the complete path length from the encoded
prefix-compressed path, we end up just allocating the complete path
without ever checking what the encoded path length actually is. This can
easily lead to a denial of service by just encoding an unreasonable long
path name inside of the index. Git already enforces a maximum path
length of 4096 bytes. As we also have that enforcement ready in some
places, just make sure that the resulting path is smaller than
GIT_PATH_MAX.
Reported-by: Krishna Ram Prakash R <krp@gtux.in>
Reported-by: Vivek Parikh <viv0411.parikh@gmail.com>
Diffstat (limited to 'include/git2')
0 files changed, 0 insertions, 0 deletions