Re: [PATCH v5] diff-delta: use safe integer arithmetic

>
> "Srujith A Poojary via GitGitGadget" <gitgitgadget@gmail.com>
> writes:
>
> > From: Srujith A Poojary <poojarysrujith@gmail.com>
> >
> > In create_delta_index(), buffer sizes for allocating the delta index
> > are calculated using arithmetic operations on entries and hsize:
> >
> >   memsize = sizeof(*hash) * hsize + sizeof(*entry) * entries
> >
> > To prevent potential size_t wrap-around when computing allocation sizes
> > on 32-bit systems, replace manual arithmetic with overflow-checked
> > helpers (st_mult, st_add, st_add3).
> >
> > For the unpacked index allocation:
> > - sizeof(struct unpacked_index_entry) is 12 bytes on 32-bit systems,
> >   which may be padded to 16 bytes depending on compiler alignment rules.
> > - sizeof(struct index_entry *) is 4 bytes.
> > - entries is capped by (0xffffffu / RABIN_WINDOW) where RABIN_WINDOW is 16,
> >   limiting entries to 1,048,575.
> > - hsize is the smallest power of 2 greater than or equal to entries,
> >   capped at 1,048,576.
> >
> > While entries is bounded in current code, using st_mult() and st_add()
> > guarantees that any unexpected growth in struct sizes or bounds changes
> > will safely die() on size_t overflow instead of wrapping around.
>
> Much more useful for future developers to learn what led to the
> conclusion.
>
> > For the packed index allocation:
> > - Passing (hsize + 1) as an argument to st_add3() is safe from overflow
> >   because hsize is capped at 1,048,576 early in the function.
>
> hsize+1 is *not* an argument to st_add3(), though.  It is given to
> st_mult().