commit 9b31ed6506b8e65348a504355903c213b90125d4
from: Stefan Sperling <stsp@stsp.name>
via: Thomas Adam <thomas@xteddy.org>
date: Sat Feb 12 17:22:05 2022 UTC

fix loose object file header parser for zero-length headers

ok millert tracey

commit - 67af9f37413a2529ee144aa57def023a428dd996
commit + 9b31ed6506b8e65348a504355903c213b90125d4
blob - 41566131473bbce2ec36f3ef27a69c9a82e238ca
blob + a375765892960296564474ea220a90dcde975a4f
--- lib/object_parse.c
+++ lib/object_parse.c
@@ -194,13 +194,14 @@ got_object_parse_header(struct got_object **obj, char 
 		GOT_OBJ_TYPE_TAG,
 	};
 	int type = 0;
-	size_t size = 0, hdrlen = 0;
+	size_t size = 0;
 	size_t i;
+	char *end;
 
 	*obj = NULL;
 
-	hdrlen = strnlen(buf, len) + 1 /* '\0' */;
-	if (hdrlen > len)
+	end = memchr(buf, '\0', len);
+	if (end == NULL)
 		return got_error(GOT_ERR_BAD_OBJ_HDR);
 
 	for (i = 0; i < nitems(obj_labels); i++) {
@@ -208,12 +209,11 @@ got_object_parse_header(struct got_object **obj, char 
 		size_t label_len = strlen(label);
 		const char *errstr;
 
-		if (strncmp(buf, label, label_len) != 0)
+		if (len <= label_len || buf + label_len >= end ||
+		    strncmp(buf, label, label_len) != 0)
 			continue;
 
 		type = obj_types[i];
-		if (len <= label_len)
-			return got_error(GOT_ERR_BAD_OBJ_HDR);
 		size = strtonum(buf + label_len, 0, LONG_MAX, &errstr);
 		if (errstr != NULL)
 			return got_error(GOT_ERR_BAD_OBJ_HDR);
@@ -227,7 +227,7 @@ got_object_parse_header(struct got_object **obj, char 
 	if (*obj == NULL)
 		return got_error_from_errno("calloc");
 	(*obj)->type = type;
-	(*obj)->hdrlen = hdrlen;
+	(*obj)->hdrlen = end - buf + 1;
 	(*obj)->size = size;
 	return NULL;
 }
@@ -247,6 +247,7 @@ got_object_read_header(struct got_object **obj, int fd
 	buf = malloc(zbsize);
 	if (buf == NULL)
 		return got_error_from_errno("malloc");
+	buf[0] = '\0';
 
 	err = got_inflate_init(&zb, buf, zbsize, NULL);
 	if (err)