Related Vulnerabilities: CVE-2016-10129  

The Git protocol does not specify what should happen in the case of an empty packet line (that is a packet line "0004"). currently it indicates success, but does not return a packet in the case where an empty line is hit. The smart protocol was not prepared to handle such packets in all cases, though, resulting in a `NULL` pointer dereference. The issue is fixed by returning an error instead.

Severity Medium

Remote Yes

Type Denial of service

Description

The Git protocol does not specify what should happen in the case of an empty packet line (that is a packet line "0004"). currently it indicates success, but does not return a packet in the case where an empty line is hit. The smart protocol was not prepared to handle such packets in all cases, though, resulting in a `NULL` pointer dereference. The issue is fixed by returning an error instead.

AVG-131 libgit2 1:0.24.3-1 1:0.24.6-1 High Fixed

15 Jan 2017 ASA-201701-21 AVG-131 libgit2 High multiple issues

https://github.com/libgit2/libgit2/commit/2fdef641fd0dd2828bd948234ae86de75221a11a