diff options
| author | Nicolas Pitre <nico@cam.org> | 2008-10-29 19:02:45 -0400 |
|---|---|---|
| committer | Junio C Hamano <gitster@pobox.com> | 2008-11-02 15:22:34 -0800 |
| commit | d8f325563d85abcd9816311b3a84093b2d1cda9f (patch) | |
| tree | f564b9bd64fd42b1bc38dfa8b0e80f52c78f60eb /builtin-pack-objects.c | |
| parent | 0e8189e2708bc1da08c77c7e1d960f420b6890a5 (diff) | |
| download | git-d8f325563d85abcd9816311b3a84093b2d1cda9f.tar.gz | |
better validation on delta base object offsets
In one case, it was possible to have a bad offset equal to 0 effectively
pointing a delta onto itself and crashing git after too many recursions.
In the other cases, a negative offset could result due to off_t being
signed. Catch those.
Signed-off-by: Nicolas Pitre <nico@cam.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 'builtin-pack-objects.c')
| -rw-r--r-- | builtin-pack-objects.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/builtin-pack-objects.c b/builtin-pack-objects.c index 1591417962..cc1e47f41a 100644 --- a/builtin-pack-objects.c +++ b/builtin-pack-objects.c @@ -1038,10 +1038,10 @@ static void check_object(struct object_entry *entry) c = buf[used_0++]; ofs = (ofs << 7) + (c & 127); } - if (ofs >= entry->in_pack_offset) + ofs = entry->in_pack_offset - ofs; + if (ofs <= 0 || ofs >= entry->in_pack_offset) die("delta base offset out of bound for %s", sha1_to_hex(entry->idx.sha1)); - ofs = entry->in_pack_offset - ofs; if (reuse_delta && !entry->preferred_base) { struct revindex_entry *revidx; revidx = find_pack_revindex(p, ofs); |