packfile.c: prevent overflow in `load_idx()`

[thirdparty/git.git] / packfile.c

diff --git a/packfile.c b/packfile.c
index 5ee67de569ea0c85cb0caad4e18ab5fe7d2c4fa9..efe4a22c63c25a9149731a1c46c3774fa7c7de4b 100644 (file)
--- a/packfile.c
+++ b/packfile.c
@@ -186,7 +186,7 @@ int load_idx(const char *path, const unsigned int hashsz, void *idx_map,
                     */
                    (sizeof(off_t) <= 4))
                        return error("pack too large for current definition of off_t in %s", path);
-               p->crc_offset = 8 + 4 * 256 + nr * hashsz;
+               p->crc_offset = st_add(8 + 4 * 256, st_mult(nr, hashsz));
        }
 
        p->index_version = version;