From 166623633e285e17b0582443c9d03b842b6370fa Mon Sep 17 00:00:00 2001
From: Javi Fontan <jfontan@gmail.com>
Date: Fri, 17 Aug 2018 18:52:18 +0200
Subject: [PATCH] object: fix panic when reading object header

When the first line of the pgp signature is an empty line or some header
is malformed it crashes as there's no data for the header element. For
example, if author name is "\n".

Signed-off-by: Javi Fontan <jfontan@gmail.com>
---
 plumbing/object/commit.go      | 16 +++++++++++-----
 plumbing/object/commit_test.go | 34 ++++++++++++++++++++++++++++++++++
 2 files changed, 45 insertions(+), 5 deletions(-)

diff --git a/plumbing/object/commit.go b/plumbing/object/commit.go
index 00ae3f144..e2543426a 100644
--- a/plumbing/object/commit.go
+++ b/plumbing/object/commit.go
@@ -199,17 +199,23 @@ func (c *Commit) Decode(o plumbing.EncodedObject) (err error) {
 			}
 
 			split := bytes.SplitN(line, []byte{' '}, 2)
+
+			var data []byte
+			if len(split) == 2 {
+				data = split[1]
+			}
+
 			switch string(split[0]) {
 			case "tree":
-				c.TreeHash = plumbing.NewHash(string(split[1]))
+				c.TreeHash = plumbing.NewHash(string(data))
 			case "parent":
-				c.ParentHashes = append(c.ParentHashes, plumbing.NewHash(string(split[1])))
+				c.ParentHashes = append(c.ParentHashes, plumbing.NewHash(string(data)))
 			case "author":
-				c.Author.Decode(split[1])
+				c.Author.Decode(data)
 			case "committer":
-				c.Committer.Decode(split[1])
+				c.Committer.Decode(data)
 			case headerpgp:
-				c.PGPSignature += string(split[1]) + "\n"
+				c.PGPSignature += string(data) + "\n"
 				pgpsig = true
 			}
 		} else {
diff --git a/plumbing/object/commit_test.go b/plumbing/object/commit_test.go
index b5dfbe325..e72b703d1 100644
--- a/plumbing/object/commit_test.go
+++ b/plumbing/object/commit_test.go
@@ -325,6 +325,22 @@ RUysgqjcpT8+iQM1PblGfHR4XAhuOqN5Fx06PSaFZhqvWFezJ28/CLyX5q+oIVk=
 	c.Assert(err, IsNil)
 	c.Assert(decoded.PGPSignature, Equals, pgpsignature)
 
+	// signature with extra empty line, it caused "index out of range" when
+	// parsing it
+
+	pgpsignature2 := "\n" + pgpsignature
+
+	commit.PGPSignature = pgpsignature2
+	encoded = &plumbing.MemoryObject{}
+	decoded = &Commit{}
+
+	err = commit.Encode(encoded)
+	c.Assert(err, IsNil)
+
+	err = decoded.Decode(encoded)
+	c.Assert(err, IsNil)
+	c.Assert(decoded.PGPSignature, Equals, pgpsignature2)
+
 	// signature in author name
 
 	commit.PGPSignature = ""
@@ -461,3 +477,21 @@ func (s *SuiteCommit) TestPatchCancel(c *C) {
 	c.Assert(err, ErrorMatches, "operation canceled")
 
 }
+
+func (s *SuiteCommit) TestMalformedHeader(c *C) {
+	encoded := &plumbing.MemoryObject{}
+	decoded := &Commit{}
+	commit := *s.Commit
+
+	commit.PGPSignature = "\n"
+	commit.Author.Name = "\n"
+	commit.Author.Email = "\n"
+	commit.Committer.Name = "\n"
+	commit.Committer.Email = "\n"
+
+	err := commit.Encode(encoded)
+	c.Assert(err, IsNil)
+
+	err = decoded.Decode(encoded)
+	c.Assert(err, IsNil)
+}