better validation on delta base object offsets

In one case, it was possible to have a bad offset equal to 0 effectively
pointing a delta onto itself and crashing git after too many recursions.
In the other cases, a negative offset could result due to off_t being
signed.  Catch those.

Signed-off-by: Nicolas Pitre <nico@cam.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/builtin-pack-objects.c b/builtin-pack-objects.c
index 15914179623d27370f02908543e9f43dbe8a31b9..cc1e47f41a6c837e5be89fd3abf2ac578fb91748 100644 (file)
--- a/builtin-pack-objects.c
+++ b/builtin-pack-objects.c
@@ -1038,10 +1038,10 @@ static void check_object(struct object_entry *entry)
                                c = buf[used_0++];
                                ofs = (ofs << 7) + (c & 127);
                        }
-                       if (ofs >= entry->in_pack_offset)
+                       ofs = entry->in_pack_offset - ofs;
+                       if (ofs <= 0 || ofs >= entry->in_pack_offset)
                                die("delta base offset out of bound for %s",
                                    sha1_to_hex(entry->idx.sha1));
-                       ofs = entry->in_pack_offset - ofs;
                        if (reuse_delta && !entry->preferred_base) {
                                struct revindex_entry *revidx;
                                revidx = find_pack_revindex(p, ofs);

diff --git a/builtin-unpack-objects.c b/builtin-unpack-objects.c
index 9f4bdd3296d19b75211ca0f2434d227eafac44b6..47ed610677fe47f855beaac02f40fa84d132455e 100644 (file)
--- a/builtin-unpack-objects.c
+++ b/builtin-unpack-objects.c
@@ -370,6 +370,8 @@ static void unpack_delta_entry(enum object_type type, unsigned long delta_size,
                        base_offset = (base_offset << 7) + (c & 127);
                }
                base_offset = obj_list[nr].offset - base_offset;
+               if (base_offset <= 0 || base_offset >= obj_list[nr].offset)
+                       die("offset value out of bound for delta base object");
 
                delta_data = get_data(delta_size);
                if (dry_run || !delta_data) {

diff --git a/index-pack.c b/index-pack.c
index 6f89bb9ac7f281434a9759956d8da23e6bc071db..da03eeeca1d60f2c375d89c72f0c3e16aaa413f5 100644 (file)
--- a/index-pack.c
+++ b/index-pack.c
@@ -334,7 +334,7 @@ static void *unpack_raw_entry(struct object_entry *obj, union delta_base *delta_
                        base_offset = (base_offset << 7) + (c & 127);
                }
                delta_base->offset = obj->idx.offset - base_offset;
-               if (delta_base->offset >= obj->idx.offset)
+               if (delta_base->offset <= 0 || delta_base->offset >= obj->idx.offset)
                        bad_object(obj->idx.offset, "delta base offset is out of bound");
                break;
        case OBJ_COMMIT:

diff --git a/sha1_file.c b/sha1_file.c
index 88d9cf357fa56310e28ce6eb19ad713b8d174645..e57949b41514c03e9b80764ecee9a4dbafa591f1 100644 (file)
--- a/sha1_file.c
+++ b/sha1_file.c
@@ -1355,7 +1355,7 @@ static off_t get_delta_base(struct packed_git *p,
                        base_offset = (base_offset << 7) + (c & 127);
                }
                base_offset = delta_obj_offset - base_offset;
-               if (base_offset >= delta_obj_offset)
+               if (base_offset <= 0 || base_offset >= delta_obj_offset)
                        return 0;  /* out of bound */
                *curpos += used;
        } else if (type == OBJ_REF_DELTA) {