[PATCH 09/20] midx: check size of object offset chunk
- From
Jeff King <peff@peff.net>
- Date
- Oct 9, 2023, 21:05 UTC
- Message-ID
- <20231009210527.GI3282181@coredump.intra.peff.net>
- In-Reply-To
- <20231009205544.GA3281950@coredump.intra.peff.net>
The object offset chunk has one fixed-size entry for each object in the midx. But since we don't check its size, we may access out-of-bounds memory if we see a corrupt or malicious midx file.
Sine the entries are fixed-size, the total length can be known up-front, and we can just check it while parsing the chunk (this is similar to what we do when opening pack idx files, which contain a similar offset table).
Signed-off-by: Jeff King <peff@peff.net> --- midx.c | 15 ++++++++++++++- t/t5319-multi-pack-index.sh | 10 ++++++++++ 2 files changed, 24 insertions(+), 1 deletion(-)
diff --git a/midx.c b/midx.c index 98f84fbe61..7b1b45f381 100644 --- a/midx.c +++ b/midx.c @@ -88,6 +88,19 @@ static int midx_read_oid_lookup(const unsigned char *chunk_start, return 0; } +static int midx_read_object_offsets(const unsigned char *chunk_start, + size_t chunk_size, void *data) +{ + struct multi_pack_index *m = data; + m->chunk_object_offsets = chunk_start; + + if (chunk_size != st_mult(m->num_objects, MIDX_CHUNK_OFFSET_WIDTH)) { + error(_("multi-pack-index object offset chunk is the wrong size")); + return 1; + } + return 0; +} + struct multi_pack_index *load_multi_pack_index(const char *object_dir, int local) { struct multi_pack_index *m = NULL; @@ -164,7 +177,7 @@ struct multi_pack_index *load_multi_pack_index(const char *object_dir, int local die(_("multi-pack-index required OID fanout chunk missing or corrupted")); if (read_chunk(cf, MIDX_CHUNKID_OIDLOOKUP, midx_read_oid_lookup, m)) die(_("multi-pack-index required OID lookup chunk missing or corrupted")); - if (pair_chunk_unsafe(cf, MIDX_CHUNKID_OBJECTOFFSETS, &m->chunk_object_offsets)) + if (read_chunk(cf, MIDX_CHUNKID_OBJECTOFFSETS, midx_read_object_offsets, m)) die(_("multi-pack-index required object offsets chunk missing or corrupted")); pair_chunk_unsafe(cf, MIDX_CHUNKID_LARGEOFFSETS, &m->chunk_large_offsets); diff --git a/t/t5319-multi-pack-index.sh b/t/t5319-multi-pack-index.sh index 34f5944142..30687d5452 100755 --- a/t/t5319-multi-pack-index.sh +++ b/t/t5319-multi-pack-index.sh @@ -1108,4 +1108,14 @@ test_expect_success 'reader handles unaligned chunks' ' test_cmp expect.err err ' +test_expect_success 'reader notices too-small object offset chunk' ' + corrupt_chunk OOFF clear 00000000 && + test_must_fail git log 2>err && + cat >expect <<-\EOF && + error: multi-pack-index object offset chunk is the wrong size + fatal: multi-pack-index required object offsets chunk missing or corrupted + EOF + test_cmp expect err +' + test_done
-- 2.42.0.884.g35e1fe1a6a