summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 825b045)
raw | patch | inline | side by side (parent: 825b045)
author | Andy Whitcroft <apw@shadowen.org> | |
Tue, 5 Sep 2006 19:00:17 +0000 (20:00 +0100) | ||
committer | Junio C Hamano <junkio@cox.net> | |
Wed, 6 Sep 2006 00:40:46 +0000 (17:40 -0700) |
When build a pack for a push we query the remote copy for existant
heads. These are used to prune unnecessary objects from the pack.
As we receive the remote references in get_remote_heads() we validate
the reference names via check_ref() which includes a length check;
rejecting those >45 characters in size.
This is a miss converted change, it was originally designed to reject
messages which were less than 45 characters in length (a 40 character
sha1 and refs/) to prevent comparing unitialised memory. check_ref()
now gets the raw length so check for at least 5 characters.
Signed-off-by: Andy Whitcroft <apw@shadowen.org>
Signed-off-by: Junio C Hamano <junkio@cox.net>
heads. These are used to prune unnecessary objects from the pack.
As we receive the remote references in get_remote_heads() we validate
the reference names via check_ref() which includes a length check;
rejecting those >45 characters in size.
This is a miss converted change, it was originally designed to reject
messages which were less than 45 characters in length (a 40 character
sha1 and refs/) to prevent comparing unitialised memory. check_ref()
now gets the raw length so check for at least 5 characters.
Signed-off-by: Andy Whitcroft <apw@shadowen.org>
Signed-off-by: Junio C Hamano <junkio@cox.net>
connect.c | patch | blob | history |
diff --git a/connect.c b/connect.c
index 06ef387649e0645b934f3294df8b843aa328393f..1c6429bd51a661f32764f674f28858f6a632ea75 100644 (file)
--- a/connect.c
+++ b/connect.c
if (!flags)
return 1;
- if (len > 45 || memcmp(name, "refs/", 5))
+ if (len < 5 || memcmp(name, "refs/", 5))
return 0;
/* Skip the "refs/" part */