Reject oversized pkt-line packets · Entire

Reject oversized pkt-line packets

6cd2c17→main·

pjbgf·2mo ago·2 files·+30 added/-1 removed

Changes

2

60 unmodified lines

61
62
63
64
64
65
66
67

60 unmodified lines

if err != nil {
        return PacketData, nil, err
    }
    if n < 4 {
    if n < 4 || n > pktline.MaxSize {
        return PacketData, nil, pktline.ErrInvalidPktLen
    }
    if n == 4 {

Minternal/gitproto/pktline.go+1/-1

4 unmodified lines

5
6
7
8
9
10
11
12
13
14
86 unmodified lines

101
102
103
104
105
106
107
108
109
110
111
112
113
114
3 unmodified lines

118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145

4 unmodified lines

"bytes"
    "errors"
    "io"
    "strings"
    "testing"

"github.com/go-git/go-git/v6/plumbing/format/pktline"

func TestPacketReaderHandlesSpecialPackets(t *testing.T) {
86 unmodified lines

name:  "uppercase non-hex",
        input: "ZZZZ",
    },
    {
        name:  "length exceeds pkt-line max",
        input: "fff1",
    },
    {
        name:  "largest 16-bit length exceeds pkt-line max",
        input: "ffff",
    },
}

for _, tt := range tests {
3 unmodified lines

if err == nil {
            t.Fatal("expected error for malformed hex length, got nil")
        }
        if !errors.Is(err, pktline.ErrInvalidPktLen) {
            t.Fatalf("error = %v, want %v", err, pktline.ErrInvalidPktLen)
        }
    }
}

func TestPacketReaderAcceptsMaxLengthPacket(t *testing.T) {
    reader := NewPacketReader(bytes.NewBufferString("fff0" + strings.Repeat("a", pktline.MaxPayloadSize)))

kind, payload, err := reader.ReadPacket()
    if err != nil {
        t.Fatalf("read max length packet: %v", err)
    }
    if kind != PacketData {
        t.Fatalf("kind = %v, want PacketData", kind)
    }
    if len(payload) != pktline.MaxPayloadSize {
        t.Fatalf("payload length = %d, want %d", len(payload), pktline.MaxPayloadSize)
    }
}

func TestPacketReaderTruncatedPayload(t *testing.T) {
    tests := []struct {
        name  string