summaryrefslogtreecommitdiff
path: root/builtin-unpack-objects.c
diff options
context:
space:
mode:
authorNicolas Pitre <nico@cam.org>2008-10-29 23:02:45 (GMT)
committerJunio C Hamano <gitster@pobox.com>2008-11-02 23:22:34 (GMT)
commitd8f325563d85abcd9816311b3a84093b2d1cda9f (patch)
treef564b9bd64fd42b1bc38dfa8b0e80f52c78f60eb /builtin-unpack-objects.c
parent0e8189e2708bc1da08c77c7e1d960f420b6890a5 (diff)
downloadgit-d8f325563d85abcd9816311b3a84093b2d1cda9f.zip
git-d8f325563d85abcd9816311b3a84093b2d1cda9f.tar.gz
git-d8f325563d85abcd9816311b3a84093b2d1cda9f.tar.bz2
better validation on delta base object offsets
In one case, it was possible to have a bad offset equal to 0 effectively pointing a delta onto itself and crashing git after too many recursions. In the other cases, a negative offset could result due to off_t being signed. Catch those. Signed-off-by: Nicolas Pitre <nico@cam.org> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 'builtin-unpack-objects.c')
-rw-r--r--builtin-unpack-objects.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/builtin-unpack-objects.c b/builtin-unpack-objects.c
index 9f4bdd3..47ed610 100644
--- a/builtin-unpack-objects.c
+++ b/builtin-unpack-objects.c
@@ -370,6 +370,8 @@ static void unpack_delta_entry(enum object_type type, unsigned long delta_size,
base_offset = (base_offset << 7) + (c & 127);
}
base_offset = obj_list[nr].offset - base_offset;
+ if (base_offset <= 0 || base_offset >= obj_list[nr].offset)
+ die("offset value out of bound for delta base object");
delta_data = get_data(delta_size);
if (dry_run || !delta_data) {