From: Nguyễn Thái Ngọc Duy <pclouds@gmail.com>
Date: Thu, 18 Aug 2011 13:36:03 +0000 (+0700)
Subject: fetch-pack: check for valid commit from server
X-Git-Tag: v1.7.6.1~10
X-Git-Url: https://git.tokkee.org/?a=commitdiff_plain;h=ec099546a9afdb73b6bf39d5d684e6fb207e2a7f;p=git.git

fetch-pack: check for valid commit from server

A malicious server can return ACK with non-existent SHA-1 or not a
commit. lookup_commit() in this case may return NULL. Do not let
fetch-pack crash by accessing NULL address in this case.

Signed-off-by: Nguyễn Thái Ngọc Duy <pclouds@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
---

diff --git a/builtin/fetch-pack.c b/builtin/fetch-pack.c
index 436798410..3c871c2da 100644
--- a/builtin/fetch-pack.c
+++ b/builtin/fetch-pack.c
@@ -395,6 +395,8 @@ static int find_common(int fd[2], unsigned char *result_sha1,
 				case ACK_continue: {
 					struct commit *commit =
 						lookup_commit(result_sha1);
+					if (!commit)
+						die("invalid commit %s", sha1_to_hex(result_sha1));
 					if (args.stateless_rpc
 					 && ack == ACK_common
 					 && !(commit->object.flags & COMMON)) {