From f5d118c19c0ff1f15e1f5cf9129d1837ecdeee39 Mon Sep 17 00:00:00 2001
From: "yiteng.nyt" <yiteng.nyt@alibaba-inc.com>
Date: Wed, 13 Dec 2023 15:25:49 +0800
Subject: plumbing: object, check filename in (*Tree).Encode

---
 plumbing/object/tree.go | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'plumbing/object')

diff --git a/plumbing/object/tree.go b/plumbing/object/tree.go
index e9f7666..7fe773d 100644
--- a/plumbing/object/tree.go
+++ b/plumbing/object/tree.go
@@ -280,6 +280,9 @@ func (t *Tree) Encode(o plumbing.EncodedObject) (err error) {
 
 	defer ioutil.CheckClose(w, &err)
 	for _, entry := range t.Entries {
+		if strings.IndexByte(entry.Name, 0) != -1 {
+			return fmt.Errorf("malformed filename %q", entry.Name)
+		}
 		if _, err = fmt.Fprintf(w, "%o %s", entry.Mode, entry.Name); err != nil {
 			return err
 		}
-- 
cgit