smart: don't access a NULL pkt pointer in strange cases

tiennou · tiennou · commit e227b64b5a19 · 2018-06-27T14:29:17.000+02:00
By clarifying what detect_caps returns on empty/missing packet, we can
be sure there are actually refs to process. The old code would blindly
dereference first, which might not have been sent at all.

Reported by Coverity, CID 1393614
diff --git a/src/transports/smart.c b/src/transports/smart.c
@@ -274,20 +274,25 @@ static int git_smart__connect(
 	first = (git_pkt_ref *)pkt;
 
 	/* Detect capabilities */
-	if (git_smart__detect_caps(&symrefs, first, &t->caps) < 0)
-		return -1;
-
-	/* If the only ref in the list is capabilities^{} with OID_ZERO, remove it */
-	if (1 == t->refs.length && !strcmp(first->head.name, "capabilities^{}") &&
-		git_oid_iszero(&first->head.oid)) {
-		git_vector_clear(&t->refs);
-		git_pkt_free((git_pkt *)first);
-	}
+	if (git_smart__detect_caps(&symrefs, first, &t->caps) == 0) {
+		/* If the only ref in the list is capabilities^{} with OID_ZERO, remove it */
+		if (1 == t->refs.length && !strcmp(first->head.name, "capabilities^{}") &&
+			git_oid_iszero(&first->head.oid)) {
+			git_vector_clear(&t->refs);
+			git_pkt_free((git_pkt *)first);
+		}
 
-	/* Keep a list of heads for _ls */
-	git_smart__update_heads(t, &symrefs);
+		/* Keep a list of heads for _ls */
+		git_smart__update_heads(t, &symrefs);
 
-	free_symrefs(&symrefs);
+		free_symrefs(&symrefs);
+	} else if (error == GIT_ENOTFOUND) {
+		/* There was no ref packet received, or the cap list was empty */
+		error = 0;
+	} else {
+		giterr_set(GITERR_NET, "invalid response");
+		return -1;
+	}
 
 	if (t->rpc && git_smart__reset_stream(t, false) < 0)
 		return -1;
diff --git a/src/transports/smart_protocol.c b/src/transports/smart_protocol.c
@@ -137,7 +137,7 @@ int git_smart__detect_caps(git_vector *out_symrefs, git_pkt_ref *pkt, transport_
 
 	/* No refs or capabilites, odd but not a problem */
 	if (pkt == NULL || pkt->capabilities == NULL)
-		return 0;
+		return GIT_ENOTFOUND;
 
 	if (git_vector_init(&symrefs, 1, NULL) < 0)
 		return -1;
