5 files changed, 48 insertions, 7 deletions
diff --git a/plumbing/protocol/packp/srvresp.go b/plumbing/protocol/packp/srvresp.go
index 8cd0a72..a9ddb53 100644
--- a/plumbing/protocol/packp/srvresp.go
+++ b/plumbing/protocol/packp/srvresp.go
@@ -101,12 +101,14 @@ func (r *ServerResponse) decodeLine(line []byte) error {
 		return fmt.Errorf("unexpected flush")
 	}
 
-	if bytes.Equal(line[0:3], ack) {
-		return r.decodeACKLine(line)
-	}
+	if len(line) >= 3 {
+		if bytes.Equal(line[0:3], ack) {
+			return r.decodeACKLine(line)
+		}
 
-	if bytes.Equal(line[0:3], nak) {
-		return nil
+		if bytes.Equal(line[0:3], nak) {
+			return nil
+		}
 	}
 
 	return fmt.Errorf("unexpected content %q", string(line))
diff --git a/plumbing/protocol/packp/srvresp_test.go b/plumbing/protocol/packp/srvresp_test.go
index aa0af52..b7270e7 100644
--- a/plumbing/protocol/packp/srvresp_test.go
+++ b/plumbing/protocol/packp/srvresp_test.go
@@ -3,6 +3,7 @@ package packp
 import (
 	"bufio"
 	"bytes"
+	"fmt"
 
 	"github.com/go-git/go-git/v5/plumbing"
 
@@ -23,6 +24,32 @@ func (s *ServerResponseSuite) TestDecodeNAK(c *C) {
 	c.Assert(sr.ACKs, HasLen, 0)
 }
 
+func (s *ServerResponseSuite) TestDecodeNewLine(c *C) {
+	raw := "\n"
+
+	sr := &ServerResponse{}
+	err := sr.Decode(bufio.NewReader(bytes.NewBufferString(raw)), false)
+	c.Assert(err, NotNil)
+	c.Assert(err.Error(), Equals, "invalid pkt-len found")
+}
+
+func (s *ServerResponseSuite) TestDecodeEmpty(c *C) {
+	raw := ""
+
+	sr := &ServerResponse{}
+	err := sr.Decode(bufio.NewReader(bytes.NewBufferString(raw)), false)
+	c.Assert(err, IsNil)
+}
+
+func (s *ServerResponseSuite) TestDecodePartial(c *C) {
+	raw := "000600\n"
+
+	sr := &ServerResponse{}
+	err := sr.Decode(bufio.NewReader(bytes.NewBufferString(raw)), false)
+	c.Assert(err, NotNil)
+	c.Assert(err.Error(), Equals, fmt.Sprintf("unexpected content %q", "00"))
+}
+
 func (s *ServerResponseSuite) TestDecodeACK(c *C) {
 	raw := "0031ACK 6ecf0ef2c2dffb796033e5a02219af86ec6584e5\n"
 
diff --git a/plumbing/protocol/packp/ulreq_decode.go b/plumbing/protocol/packp/ulreq_decode.go
index 895a3bf..3da2998 100644
--- a/plumbing/protocol/packp/ulreq_decode.go
+++ b/plumbing/protocol/packp/ulreq_decode.go
@@ -43,7 +43,7 @@ func (d *ulReqDecoder) Decode(v *UploadRequest) error {
 	return d.err
 }
 
-// fills out the parser stiky error
+// fills out the parser sticky error
 func (d *ulReqDecoder) error(format string, a ...interface{}) {
 	msg := fmt.Sprintf(
 		"pkt-line %d: %s", d.nLine,
diff --git a/plumbing/protocol/packp/ulreq_decode_test.go b/plumbing/protocol/packp/ulreq_decode_test.go
index efcc7b4..7658922 100644
--- a/plumbing/protocol/packp/ulreq_decode_test.go
+++ b/plumbing/protocol/packp/ulreq_decode_test.go
@@ -398,7 +398,7 @@ func (s *UlReqDecodeSuite) TestDeepenCommits(c *C) {
 	c.Assert(int(commits), Equals, 1234)
 }
 
-func (s *UlReqDecodeSuite) TestDeepenCommitsInfiniteInplicit(c *C) {
+func (s *UlReqDecodeSuite) TestDeepenCommitsInfiniteImplicit(c *C) {
 	payloads := []string{
 		"want 3333333333333333333333333333333333333333 ofs-delta multi_ack",
 		"deepen 0",
diff --git a/plumbing/protocol/packp/uppackresp_test.go b/plumbing/protocol/packp/uppackresp_test.go
index 8fbf924..ec56507 100644
--- a/plumbing/protocol/packp/uppackresp_test.go
+++ b/plumbing/protocol/packp/uppackresp_test.go
@@ -3,6 +3,7 @@ package packp
 import (
 	"bytes"
 	"io"
+	"testing"
 
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/protocol/packp/capability"
@@ -128,3 +129,14 @@ func (s *UploadPackResponseSuite) TestEncodeMultiACK(c *C) {
 	b := bytes.NewBuffer(nil)
 	c.Assert(res.Encode(b), NotNil)
 }
+
+func FuzzDecoder(f *testing.F) {
+
+	f.Fuzz(func(t *testing.T, input []byte) {
+		req := NewUploadPackRequest()
+		res := NewUploadPackResponse(req)
+		defer res.Close()
+
+		res.Decode(io.NopCloser(bytes.NewReader(input)))
+	})
+}