Merge pull request #868 from pjbgf/fix-fuzz

plumbing: protocol/packp, Add validation for decodeLine

2 files changed, 34 insertions, 5 deletions

diff --git a/plumbing/protocol/packp/srvresp.go b/plumbing/protocol/packp/srvresp.go
index 8cd0a72..a9ddb53 100644
--- a/plumbing/protocol/packp/srvresp.go
+++ b/plumbing/protocol/packp/srvresp.go
@@ -101,12 +101,14 @@ func (r *ServerResponse) decodeLine(line []byte) error {
 		return fmt.Errorf("unexpected flush")
 	}
 
-	if bytes.Equal(line[0:3], ack) {
-		return r.decodeACKLine(line)
-	}
+	if len(line) >= 3 {
+		if bytes.Equal(line[0:3], ack) {
+			return r.decodeACKLine(line)
+		}
 
-	if bytes.Equal(line[0:3], nak) {
-		return nil
+		if bytes.Equal(line[0:3], nak) {
+			return nil
+		}
 	}
 
 	return fmt.Errorf("unexpected content %q", string(line))
diff --git a/plumbing/protocol/packp/srvresp_test.go b/plumbing/protocol/packp/srvresp_test.go
index aa0af52..b7270e7 100644
--- a/plumbing/protocol/packp/srvresp_test.go
+++ b/plumbing/protocol/packp/srvresp_test.go
@@ -3,6 +3,7 @@ package packp
 import (
 	"bufio"
 	"bytes"
+	"fmt"
 
 	"github.com/go-git/go-git/v5/plumbing"
 
@@ -23,6 +24,32 @@ func (s *ServerResponseSuite) TestDecodeNAK(c *C) {
 	c.Assert(sr.ACKs, HasLen, 0)
 }
 
+func (s *ServerResponseSuite) TestDecodeNewLine(c *C) {
+	raw := "\n"
+
+	sr := &ServerResponse{}
+	err := sr.Decode(bufio.NewReader(bytes.NewBufferString(raw)), false)
+	c.Assert(err, NotNil)
+	c.Assert(err.Error(), Equals, "invalid pkt-len found")
+}
+
+func (s *ServerResponseSuite) TestDecodeEmpty(c *C) {
+	raw := ""
+
+	sr := &ServerResponse{}
+	err := sr.Decode(bufio.NewReader(bytes.NewBufferString(raw)), false)
+	c.Assert(err, IsNil)
+}
+
+func (s *ServerResponseSuite) TestDecodePartial(c *C) {
+	raw := "000600\n"
+
+	sr := &ServerResponse{}
+	err := sr.Decode(bufio.NewReader(bytes.NewBufferString(raw)), false)
+	c.Assert(err, NotNil)
+	c.Assert(err.Error(), Equals, fmt.Sprintf("unexpected content %q", "00"))
+}
+
 func (s *ServerResponseSuite) TestDecodeACK(c *C) {
 	raw := "0031ACK 6ecf0ef2c2dffb796033e5a02219af86ec6584e5\n"