From: Derrick Stolee <stolee@gmail.com>
Date: Thu, 06 Dec 2018 13:11:28 GMT
Subject: Re: [PATCH 2/2] commit-graph: fix buffer read-overflow
Message-ID: <077fed80-8d8c-1ed9-b2b6-18b86887482f@gmail.com>
In-Reply-To: <ad2e761f4438ac80e947be0f6831fb6467eb4396.1544048946.git.steadmon@google.com>

On 12/5/2018 5:32 PM, Josh Steadmon wrote:
>   
> +		if (chunk_lookup + GRAPH_CHUNKLOOKUP_WIDTH > data + graph_size) {
> +			error(_("chunk lookup table entry missing; graph file may be incomplete"));
> +			free(graph);
> +			return NULL;
> +		}

Something I forgot earlier: there are several tests in 
t5318-commit-graph.sh that use 'git commit-graph verify' to ensure we 
hit these error conditions on a corrupted commit-graph file. Could you 
try adding a test there that looks for this error message?

Thanks,
-Stolee