From: Junio C Hamano <gitster@pobox.com>
Date: Fri, 17 Mar 2017 20:50:26 +0000 (-0700)
Subject: Merge branch 'jk/http-walker-buffer-underflow-fix'
X-Git-Tag: v2.13.0-rc0~104
X-Git-Url: https://www.git.lorimer.id.au/gitweb.git/diff_plain/2af882be0181ee29aa3a4fb3181b94e9bca53c51?hp=f6c64c648ade843b44d517b2de41b8b882f112c0

Merge branch 'jk/http-walker-buffer-underflow-fix'

"Dumb http" transport used to misparse a nonsense http-alternates
response, which has been fixed.

* jk/http-walker-buffer-underflow-fix:
http-walker: fix buffer underflow processing remote alternates
---

diff --git a/http-walker.c b/http-walker.c
index ab7d5537ae..ee049cb13d 100644
--- a/http-walker.c
+++ b/http-walker.c
@@ -301,13 +301,16 @@ static void process_alternates_response(void *callback_data)
 					okay = 1;
 				}
 			}
-			/* skip "objects\n" at end */
 			if (okay) {
 				struct strbuf target = STRBUF_INIT;
 				strbuf_add(&target, base, serverlen);
-				strbuf_add(&target, data + i, posn - i - 7);
-
-				if (is_alternate_allowed(target.buf)) {
+				strbuf_add(&target, data + i, posn - i);
+				if (!strbuf_strip_suffix(&target, "objects")) {
+					warning("ignoring alternate that does"
+						" not end in 'objects': %s",
+						target.buf);
+					strbuf_release(&target);
+				} else if (is_alternate_allowed(target.buf)) {
 					warning("adding alternate object store: %s",
 						target.buf);
 					newalt = xmalloc(sizeof(*newalt));