Re: [PATCH] http-walker: fix buffer underflow processing remote alternates

2017-03-13 Thread Jeff King
On Sun, Mar 12, 2017 at 10:59:09PM -0700, Junio C Hamano wrote: > > Let's fix this by using strbuf_strip_suffix() to drop the > > characters we want. As a bonus this lets us handle names > > that do not end in "objects" (all git repos do, but there is > > nothing to say that an alternate object st

Re: [PATCH] http-walker: fix buffer underflow processing remote alternates

2017-03-12 Thread Junio C Hamano
Jeff King writes: > If we parse a remote alternates (or http-alternates), we > expect relative lines like: > > ../../foo.git/objects > > which we convert into "$URL/../foo.git/" (and then use that > as a base for fetching more objects). > > But if the remote feeds us nonsense like just: > > .

Re: [PATCH] http-walker: fix buffer underflow processing remote alternates

2017-03-12 Thread Jeff King
On Sun, Mar 12, 2017 at 08:38:53AM -0400, Jeff King wrote: > I posted this last week in the middle of another thread[1], but it > didn't get any attention. So here it is again. Oops, that [1] should be: http://public-inbox.org/git/20170304034914.cgyvz735lxhe2...@sigill.intra.peff.net/ -Peff

[PATCH] http-walker: fix buffer underflow processing remote alternates

2017-03-12 Thread Jeff King
If we parse a remote alternates (or http-alternates), we expect relative lines like: ../../foo.git/objects which we convert into "$URL/../foo.git/" (and then use that as a base for fetching more objects). But if the remote feeds us nonsense like just: ../ we will try to blindly strip the l