From d37dc239a427a367427f9c4fdf12a148ad811968 Mon Sep 17 00:00:00 2001 From: Matthew DeVore Date: Tue, 4 Jun 2019 10:57:05 -0700 Subject: [PATCH] url: do not allow %00 to represent NUL in URLs There is no reason to allow %00 to terminate a string, so do not allow it. Otherwise, we end up returning arbitrary content in the string (that which is after the %00) which is effectively hidden from callers and can escape sanity checks and validation, and possible be used in tandem with a security vulnerability to introduce a payload. Helped-by: brian m. carlson Signed-off-by: Matthew DeVore Signed-off-by: Junio C Hamano --- url.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/url.c b/url.c index 9ea9d5611b..1b8ef78cea 100644 --- a/url.c +++ b/url.c @@ -48,7 +48,7 @@ static char *url_decode_internal(const char **query, int len, if (c == '%' && (len < 0 || len >= 3)) { int val = hex2chr(q + 1); - if (0 <= val) { + if (0 < val) { strbuf_addch(out, val); q += 3; len -= 3;