[PATCH 02/13] declare overflow during base128 decoding when 1 MSB nonzero, not 7
---
builtin-pack-objects.c | 2 +-
builtin-unpack-objects.c | 2 +-
index-pack.c | 2 +-
sha1_file.c | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)
--
Dana L. How danahow@gmail.com +1 650 804 5991 cell
From 90937b722f391abe1cbc035c29b33f500c389334 Mon Sep 17 00:00:00 2001
From: Dana How <how@deathvalley.cswitch.com>
Date: Thu, 5 Apr 2007 12:15:22 -0700
Subject: [PATCH 02/13] declare overflow during base128 decoding when 1 MSB nonzero, not 7
---
builtin-pack-objects.c | 2 +-
builtin-unpack-objects.c | 2 +-
index-pack.c | 2 +-
sha1_file.c | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/builtin-pack-objects.c b/builtin-pack-objects.c
index b5f9648..50246e1 100644
--- a/builtin-pack-objects.c
+++ b/builtin-pack-objects.c
@@ -1014,7 +1014,7 @@ static void check_object(struct object_entry *entry)
ofs = c & 127;
while (c & 128) {
ofs += 1;
- if (!ofs || ofs & ~(~0UL >> 7))
+ if (!ofs || ofs & ~(~0UL >> 1))
die("delta base offset overflow in pack for %s",
sha1_to_hex(entry->sha1));
c = buf[used_0++];
diff --git a/builtin-unpack-objects.c b/builtin-unpack-objects.c
index 3956c56..84a6c5c 100644
--- a/builtin-unpack-objects.c
+++ b/builtin-unpack-objects.c
@@ -209,7 +209,7 @@ static void unpack_delta_entry(enum object_type type, unsigned long delta_size,
base_offset = c & 127;
while (c & 128) {
base_offset += 1;
- if (!base_offset || base_offset & ~(~0UL >> 7))
+ if (!base_offset || base_offset & ~(~0UL >> 1))
die("offset value overflow for delta base object");
pack = fill(1);
c = *pack;
diff --git a/index-pack.c b/index-pack.c
index 3c768fb..02722f7 100644
--- a/index-pack.c
+++ b/index-pack.c
@@ -249,7 +249,7 @@ static void *unpack_raw_entry(struct object_entry *obj, union delta_base *delta_
base_offset = c & 127;
while (c & 128) {
base_offset += 1;
- if (!base_offset || base_offset & ~(~0UL >> 7))
+ if (!base_offset || base_offset & ~(~0UL >> 1))
bad_object(obj->offset, "offset value overflow for delta base object");
p = fill(1);
c = *p;
diff --git a/sha1_file.c b/sha1_file.c
index 9c26038..7082d3e 100644
--- a/sha1_file.c
+++ b/sha1_file.c
@@ -1149,7 +1149,7 @@ static off_t get_delta_base(struct packed_git *p,
base_offset = c & 127;
while (c & 128) {
base_offset += 1;
- if (!base_offset || base_offset & ~(~0UL >> 7))
+ if (!base_offset || base_offset & ~(~0UL >> 1))
die("offset value overflow for delta base object");
c = base_info[used++];
base_offset = (base_offset << 7) + (c & 127);
--
1.5.1.rc2.18.g9c88-dirty