commit 70e6418ec50331f61e1c705e3c73a659b496bcdd
from: Stefan Sperling <stsp@stsp.name>
via: Thomas Adam <thomas@xteddy.org>
date: Thu Mar 10 21:00:58 2022 UTC

make got_repo_match_object_id_prefix() reject overlong input strings

suggested by + ok naddy

commit - eb3a31e3f279ccfa3de3a8647ecb790e2342109d
commit + 70e6418ec50331f61e1c705e3c73a659b496bcdd
blob - 869a01509fa0e3327ca53f0dd8ab3844302e24b8
blob + a7c2e0f246cc3c3568df8293679707567e5ec8e1
--- lib/repository.c
+++ lib/repository.c
@@ -1668,13 +1668,16 @@ got_repo_match_object_id_prefix(struct got_object_id *
 
 	*id = NULL;
 
-	for (i = 0; i < strlen(id_str_prefix); i++) {
+	len = strlen(id_str_prefix);
+	if (len > SHA1_DIGEST_STRING_LENGTH - 1)
+		return got_error_path(id_str_prefix, GOT_ERR_BAD_OBJ_ID_STR);
+
+	for (i = 0; i < len; i++) {
 		if (isxdigit((unsigned char)id_str_prefix[i]))
 			continue;
 		return got_error_path(id_str_prefix, GOT_ERR_BAD_OBJ_ID_STR);
 	}
 
-	len = strlen(id_str_prefix);
 	if (len >= 2) {
 		err = match_packed_object(id, repo, id_str_prefix, obj_type);
 		if (err)