[PATCH] fetch-pack: check for valid commit from server

From: Nguyễn Thái Ngọc Duy <pclouds@gmail.com>
Date: Aug 18, 2011, 13:36 UTC
Message-ID: <1313674563-12755-1-git-send-email-pclouds@gmail.com>

A malicious server can return ACK with non-existent SHA-1 or not a commit. lookup_commit() in this case may return NULL. Do not let fetch-pack crash by accessing NULL address in this case.

Signed-off-by: Nguyễn Thái Ngọc Duy <pclouds@gmail.com>
---
  However it raises another question, what if the other end returns a
  valid commit, but not the one in "have" line fetch-pack sent? Are we
  OK with that?

 builtin/fetch-pack.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/builtin/fetch-pack.c b/builtin/fetch-pack.c
index 4367984..3c871c2 100644
--- a/builtin/fetch-pack.c
+++ b/builtin/fetch-pack.c
@@ -395,6 +395,8 @@ static int find_common(int fd[2], unsigned char *result_sha1,
 				case ACK_continue: {
 					struct commit *commit =
 						lookup_commit(result_sha1);
+					if (!commit)
+						die("invalid commit %s", sha1_to_hex(result_sha1));
 					if (args.stateless_rpc
 					 && ack == ACK_common
 					 && !(commit->object.flags & COMMON)) {

-- 
1.7.4.74.g639db