mirror/ git
1
0
Fork 0
mirror of https://github.com/git/git.git synced 2024-04-27 07:05:08 +02:00
Code

packfile.c: prevent overflow in `load_idx()` 

Prevent an overflow when locating a pack's CRC offset when the number
of packed items is greater than 2^32-1/hashsz by guarding the
computation with an `st_mult()`.

Note that to avoid truncating the result, the `crc_offset` member must
itself become a `size_t`. The only usage of this variable (besides the
assignment in `load_idx()`) is in `read_v2_anomalous_offsets()` in the
index-pack code. There we use the `crc_offset` as a pointer offset, so
we are already equipped to handle the type change.

Helped-by: Phillip Wood <phillip.wood@dunelm.org.uk>
Signed-off-by: Taylor Blau <me@ttaylorr.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
Taylor Blau 2023-07-13 20:54:54 -04:00 committed by Junio C Hamano
parent de41d03e1c
commit 42be681b33
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
object-store.h
View File

@ -110,7 +110,7 @@ struct packed_git {
const void *index_data;
size_t index_size;
uint32_t num_objects;
uint32_t crc_offset;
size_t crc_offset;
struct oidset bad_objects;
int index_version;
time_t mtime;

2
packfile.c
View File

@ -186,7 +186,7 @@ int load_idx(const char *path, const unsigned int hashsz, void *idx_map,
*/
(sizeof(off_t) <= 4))
return error("pack too large for current definition of off_t in %s", path);
p->crc_offset = 8 + 4 * 256 + nr * hashsz;
p->crc_offset = st_add(8 + 4 * 256, st_mult(nr, hashsz));
}
p->index_version = version;