Merge branch 'fix-loose-parsing'

Author: Byron

git-object/src/object/mod.rs

@@ -180,7 +180,14 @@ impl<'a> ObjectRef<'a> {
     /// Deserialize an object from a loose serialisation
     pub fn from_loose(data: &'a [u8]) -> Result<ObjectRef<'a>, LooseDecodeError> {
         let (kind, size, offset) = loose_header(data)?;
-        Ok(Self::from_bytes(kind, &data[offset..][..size])?)
+
+        let body = &data[offset..]
+            .get(..size)
+            .ok_or(LooseHeaderDecodeError::InvalidHeader {
+                message: "object data was shorter than its size declared in the header",
+            })?;
+
+        Ok(Self::from_bytes(kind, body)?)
     }
 
     /// Deserialize an object of `kind` from the given `data`.

git-object/tests/loose.rs

@@ -1,5 +1,5 @@
 use bstr::ByteSlice;
-use git_object::{decode, encode, Kind};
+use git_object::{decode, encode, Kind, ObjectRef};
 
 #[test]
 fn all() -> Result<(), Box<dyn std::error::Error>> {
@@ -18,3 +18,11 @@ fn all() -> Result<(), Box<dyn std::error::Error>> {
     }
     Ok(())
 }
+
+#[test]
+fn shorter_than_advertised() {
+    assert_eq!(
+        ObjectRef::from_loose(b"tree 1000\x00").unwrap_err().to_string(),
+        "object data was shorter than its size declared in the header"
+    );
+}