Re: [PATCH] Avoid infinite loop in malformed packfiles
- From
- ori@eigenstate.org <ori@eigenstate.org>
- Date
- Aug 23, 2020, 02:52 UTC
- Message-ID
- <5374D56FBAB7F3BCD976B433934DEFCA@eigenstate.org>
- In-Reply-To
- <20200823005236.10386-1-ori@eigenstate.org>
Show 15 quoted lines
> In packfile.c:1680, there's an infinite loop that tries to get > to the base of a packfile. With offset deltas, the offset needs > to be greater than 0, so it's always walking backwards, and the > search is guaranteed to terminate. > > With reference deltas, there's no check for a cycle in the > references, so a cyclic reference will cause git to loop > infinitely, growing the delta_stack infinitely, which will > cause it to consume all available memory as as a full CPU > core. > > This change puts an arbitrary limit of 10,000 on the number > of iterations we make when chasing down a base commit, to > prevent looping forever, using all available memory growing > the delta stack.
For context, I discovered this accidentally when I introduced a bug in pack deltification in git9 (my implementation of git for plan 9). An example of a packfile and index that will reproduce this issue is available here:
https://eigenstate.org/tmp/95a0f4f3f3f21d723d501552eaf22ff4055e13a4.pack https://eigenstate.org/tmp/95a0f4f3f3f21d723d501552eaf22ff4055e13a4.idx
The suggestion to just cap the depth instead of doing full cycle detection came from Jeff King (peff@peff.net)