Merge branch 'jt/pack-header-lshift-overflow'

The code to decode the length of packed object size has been
corrected.

* jt/pack-header-lshift-overflow:
  packfile: avoid overflowing shift during decode

diff --git a/packfile.c b/packfile.c
index 6423d77faad46cef05497a3e2750726623318e22..e30b051c8a3fe3d50f4bea750efb87326e38362e 100644 (file)
--- a/packfile.c
+++ b/packfile.c
@@ -1068,7 +1068,7 @@ unsigned long unpack_object_header_buffer(const unsigned char *buf,
        size = c & 15;
        shift = 4;
        while (c & 0x80) {
-               if (len <= used || bitsizeof(long) <= shift) {
+               if (len <= used || (bitsizeof(long) - 7) <= shift) {
                        error("bad object header");
                        size = used = 0;
                        break;