]> git.ipfire.org Git - thirdparty/git.git/commit
packfile.c: prevent overflow in `load_idx()`
authorTaylor Blau <me@ttaylorr.com>
Fri, 14 Jul 2023 00:54:54 +0000 (20:54 -0400)
committerJunio C Hamano <gitster@pobox.com>
Fri, 14 Jul 2023 16:31:34 +0000 (09:31 -0700)
commit42be681b33ef73be056fb99e3c63c6e9b9c2e7ef
treedcdb2e0ebeebbd83ba1e560792edeb69225a6888
parentde41d03e1c7ab73174716c99b8eaf7ff5884d6bb
packfile.c: prevent overflow in `load_idx()`

Prevent an overflow when locating a pack's CRC offset when the number
of packed items is greater than 2^32-1/hashsz by guarding the
computation with an `st_mult()`.

Note that to avoid truncating the result, the `crc_offset` member must
itself become a `size_t`. The only usage of this variable (besides the
assignment in `load_idx()`) is in `read_v2_anomalous_offsets()` in the
index-pack code. There we use the `crc_offset` as a pointer offset, so
we are already equipped to handle the type change.

Helped-by: Phillip Wood <phillip.wood@dunelm.org.uk>
Signed-off-by: Taylor Blau <me@ttaylorr.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
object-store.h
packfile.c