Re: Segmentation fault found while fuzzing .pack file under 2.7.0.rc3

From: Jeff King <peff@peff.net>
Date: Feb 24, 2016, 11:05 UTC
Message-ID: <20160224110548.GA21620@sigill.intra.peff.net>
In-Reply-To: <xmqqtwmp2e6d.fsf@gitster.mtv.corp.google.com>

On Thu, Jan 07, 2016 at 02:54:50PM -0800, Junio C Hamano wrote:

Show 11 quoted lines

> We do not check if the offset of individual objects are within the
> corresponding .pack file, either, and nth_packed_object_offset()
> does return the data read from .idx file that is not checked for
> sanity.  use_pack(), which is the helper used by the callers of
> nth_packed_object_offset() that finds the offset in the packfile for
> each object, avoids allowing a read access to mapped pack data
> beyond the end of it, so it is OK to return bogus value that was
> read from the .idx file from this function, but there is one
> computation the function itself does using a possibly bogus value
> read from the disk: to find out where in the secondary offset table
> in the .idx file the offset in the packfile is stored.

Looks like this topic got dropped. I was reminded of it when somebody pointed me to a similar case[1] today which segfaults in a similar way (but this time was caused by actual filesystem corruption).

Did you ever push the patch below further along?

I confirmed that your patch detects and complains on this newer case. Though I think there is another similar problem in read_v2_anomalous_offsets (I haven't dug, but it triggers for me in "index-pack --verify").

-Peff

[1] https://github.com/libgit2/libgit2/issues/3556