From: Junio C Hamano <gitster@pobox.com>
Date: Thu, 30 Mar 2017 21:07:18 +0000 (-0700)
Subject: Merge branch 'bc/push-cert-receive-fix'
X-Git-Tag: v2.13.0-rc0~36
X-Git-Url: https://www.git.lorimer.id.au/gitweb.git/diff_plain/e711824c5ec4eb65f5022c75f33a4c5f0b157b65?hp=cd49f9bfb8c23621f618d110f2b95853728be2ba

Merge branch 'bc/push-cert-receive-fix'

"git receive-pack" could have been forced to die by attempting
allocate an unreasonably large amount of memory with a crafted push
certificate; this has been fixed.

* bc/push-cert-receive-fix:
builtin/receive-pack: fix incorrect pointer arithmetic
---

diff --git a/builtin/receive-pack.c b/builtin/receive-pack.c
index fb2a090a0c..aca9c33d8d 100644
--- a/builtin/receive-pack.c
+++ b/builtin/receive-pack.c
@@ -1524,7 +1524,7 @@ static void queue_commands_from_cert(struct command **tail,
 
 	while (boc < eoc) {
 		const char *eol = memchr(boc, '\n', eoc - boc);
-		tail = queue_command(tail, boc, eol ? eol - boc : eoc - eol);
+		tail = queue_command(tail, boc, eol ? eol - boc : eoc - boc);
 		boc = eol ? eol + 1 : eoc;
 	}
 }