{"thread":{"id":"56778","subject":"[BUG] Integer overflow bug in cache-tree.c","startedAt":"2021-10-25T07:39:36Z","lastAt":"2021-10-25T07:39:36Z","messageCount":1,"participants":["Yiyuan guo"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"439514","messageId":"CAM7=BFoQ3-VfES+n-pH7Oukq1PODVbE9Uu9Y-4XuSA5SjQo=uw@mail.gmail.com","threadId":"56778","inReplyTo":null,"subject":"[BUG] Integer overflow bug in cache-tree.c","fromName":"Yiyuan guo","fromEmail":"yguoaz@gmail.com","sentAt":"2021-10-25T07:39:23Z","receivedAt":"2021-10-25T07:39:36Z","isPatch":false,"sender":{"key":"yguoaz@gmail.com","avatar":null},"body":"In the file cache-tree.c, the function \"static struct cache_tree\n*read_one(const char **buffer, unsigned long *size_p)\"\nhas the following code\n(link:https://github.com/git/git/blob/9d530dc0024503ab4218fe6c4395b8a0aa245478/cache-tree.c#L592-#L593):\n\nint subtree_nr;\nsubtree_nr = strtol(cp, &ep, 10);\n\nit->subtree_alloc = subtree_nr + 2;\nCALLOC_ARRAY(it->down, it->subtree_alloc);\n\nThe variable subtree_nr is converted from the string buffer. Suppose\nit equals INT_MAX, the computation of\nit->subtree_alloc can trigger a signed integer overflow, which is\nlater used to calculate allocation size.\n\nThis can cause security problems if the function do_read_index is\ngiven a crafted index file.\n"}]}