Commit Diff
--- lib/privsep.c +++ lib/privsep.c @@ -1657,6 +1657,10 @@ got_privsep_recv_tree(struct got_tree_object **tree, s if (datalen + 1 > sizeof(te->name)) { err = got_error(GOT_ERR_NO_SPACE); + break; + } + if (nentries >= (*tree)->nentries) { + err = got_error(GOT_ERR_PRIVSEP_LEN); break; } te = &(*tree)->entries[nentries];