]> git.ipfire.org Git - thirdparty/git.git/commit - sha1_file.c
use_pack: handle signed off_t overflow
authorJeff King <peff@peff.net>
Thu, 25 Feb 2016 14:23:26 +0000 (09:23 -0500)
committerJunio C Hamano <gitster@pobox.com>
Thu, 25 Feb 2016 19:32:46 +0000 (11:32 -0800)
commit13e0b0d3dc76353632dcb0bc63cdf03426154317
treea9ecffdfc2b839b81fc7b4d5aa1e543639a9cec3
parent47fe3f6ef0f5a336db90d816c5fb4330ffa23668
use_pack: handle signed off_t overflow

A v2 pack index file can specify an offset within a packfile
of up to 2^64-1 bytes. On a system with a signed 64-bit
off_t, we can represent only up to 2^63-1. This means that a
corrupted .idx file can end up with a negative offset in the
pack code. Our bounds-checking use_pack function looks for
too-large offsets, but not for ones that have wrapped around
to negative. Let's do so, which fixes an out-of-bounds
access demonstrated in t5313.

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
sha1_file.c
t/t5313-pack-bounds-checks.sh