git/list[1] front-page[2] threads[3] people[4] search[5] about
 

[PATCH 08/20] midx.c: prevent overflow in `write_midx_internal()`

From
Taylor Blau <me@ttaylorr.com>
Date
Jul 12, 2023, 23:37 UTC
Message-ID
<09bd84700bd1904cd5340d5c4dbf7bd84ae1922d.1689205042.git.me@ttaylorr.com>
In-Reply-To
<cover.1689205042.git.me@ttaylorr.com>

When writing a MIDX, we use the chunk-format API to write out each individual chunk of the MIDX. Each chunk of the MIDX is tracked via a call to `add_chunk()`, along with the expected size of that chunk.

Guard against overflow when dealing with a MIDX with a large number of entries (and consequently, large chunks within the MIDX file itself) to avoid corrupting the contents of the MIDX itself.

Signed-off-by: Taylor Blau <me@ttaylorr.com>
---
 midx.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/midx.c b/midx.c
index b176745df1..57c53dbd4a 100644
--- a/midx.c
+++ b/midx.c
@@ -1501,21 +1501,22 @@ static int write_midx_internal(const char *object_dir,
 	add_chunk(cf, MIDX_CHUNKID_OIDFANOUT, MIDX_CHUNK_FANOUT_SIZE,
 		  write_midx_oid_fanout);
 	add_chunk(cf, MIDX_CHUNKID_OIDLOOKUP,
-		  (size_t)ctx.entries_nr * the_hash_algo->rawsz,
+		  st_mult(ctx.entries_nr, the_hash_algo->rawsz),
 		  write_midx_oid_lookup);
 	add_chunk(cf, MIDX_CHUNKID_OBJECTOFFSETS,
-		  (size_t)ctx.entries_nr * MIDX_CHUNK_OFFSET_WIDTH,
+		  st_mult(ctx.entries_nr, MIDX_CHUNK_OFFSET_WIDTH),
 		  write_midx_object_offsets);
 
 	if (ctx.large_offsets_needed)
 		add_chunk(cf, MIDX_CHUNKID_LARGEOFFSETS,
-			(size_t)ctx.num_large_offsets * MIDX_CHUNK_LARGE_OFFSET_WIDTH,
+			st_mult(ctx.num_large_offsets,
+				MIDX_CHUNK_LARGE_OFFSET_WIDTH),
 			write_midx_large_offsets);
 
 	if (flags & (MIDX_WRITE_REV_INDEX | MIDX_WRITE_BITMAP)) {
 		ctx.pack_order = midx_pack_order(&ctx);
 		add_chunk(cf, MIDX_CHUNKID_REVINDEX,
-			  ctx.entries_nr * sizeof(uint32_t),
+			  st_mult(ctx.entries_nr, sizeof(uint32_t)),
 			  write_midx_revindex);
 	}
 

-- 
2.41.0.347.g7b976b8871f
Previous: Taylor BlauNext: Taylor Blau
Message 15 of 28 in “guard object lookups against 32-bit overflow”
  1. 00/20 guard object lookups against 32-bit overflowTaylor Blau, Jul 12, 2023
  2. 01/20 packfile.c: prevent overflow in `nth_packed_object_id()`Taylor Blau, Jul 12, 2023
  3. 02/20 packfile.c: prevent overflow in `load_idx()`Taylor Blau, Jul 12, 2023
  4. Phillip WoodJul 13, 2023
  5. Taylor BlauJul 13, 2023
  6. Taylor BlauJul 14, 2023
  7. Phillip WoodJul 14, 2023
  8. Junio C HamanoJul 14, 2023
  9. Phillip WoodJul 14, 2023
  10. Junio C HamanoJul 13, 2023
  11. 03/20 packfile.c: use checked arithmetic in `nth_packed_object_offset()`Taylor Blau, Jul 12, 2023
  12. 04/20 midx.c: use `size_t`'s for fanout nr and allocTaylor Blau, Jul 12, 2023
  13. 05/20 midx.c: prevent overflow in `nth_midxed_object_oid()`Taylor Blau, Jul 12, 2023
  14. 06/20 midx.c: prevent overflow in `nth_midxed_offset()`Taylor Blau, Jul 12, 2023
  15. 08/20 midx.c: prevent overflow in `write_midx_internal()`Taylor Blau, Jul 12, 2023
  16. 09/20 midx.c: prevent overflow in `fill_included_packs_batch()`Taylor Blau, Jul 12, 2023
  17. 10/20 pack-bitmap.c: ensure that eindex lookups don't overflowTaylor Blau, Jul 12, 2023
  18. 11/20 commit-graph.c: prevent overflow in `write_commit_graph_file()`Taylor Blau, Jul 12, 2023
  19. 12/20 commit-graph.c: prevent overflow in add_graph_to_chain()Taylor Blau, Jul 12, 2023
  20. 13/20 commit-graph.c: prevent overflow in `load_oid_from_graph()`Taylor Blau, Jul 12, 2023
  21. 14/20 commit-graph.c: prevent overflow in `fill_commit_graph_info()`Taylor Blau, Jul 12, 2023
  22. 15/20 commit-graph.c: prevent overflow in `fill_commit_in_graph()`Taylor Blau, Jul 12, 2023
  23. 16/20 commit-graph.c: prevent overflow in `load_tree_for_commit()`Taylor Blau, Jul 12, 2023
  24. 17/20 commit-graph.c: prevent overflow in `split_graph_merge_strategy()`Taylor Blau, Jul 12, 2023
  25. 18/20 commit-graph.c: prevent overflow in `merge_commit_graph()`Taylor Blau, Jul 12, 2023
  26. 19/20 commit-graph.c: prevent overflow in `write_commit_graph()`Taylor Blau, Jul 12, 2023
  27. 20/20 commit-graph.c: prevent overflow in `verify_commit_graph()`Taylor Blau, Jul 12, 2023
  28. 07/20 midx.c: store `nr`, `alloc` variables as `size_t`'sTaylor Blau, Jul 12, 2023

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.