From: Srujith Poojary Date: Tue, 27 Oct 2026 04:50:03 GMT Subject: Re: [PATCH v5] diff-delta: use safe integer arithmetic Message-ID: In-Reply-To: On Mon, Oct 26, 2026 at 11:07 PM Junio C Hamano wrote: > > "Srujith A Poojary via GitGitGadget" > writes: > > > From: Srujith A Poojary > > > > In create_delta_index(), buffer sizes for allocating the delta index > > are calculated using arithmetic operations on entries and hsize: > > > > memsize = sizeof(*hash) * hsize + sizeof(*entry) * entries > > > > To prevent potential size_t wrap-around when computing allocation sizes > > on 32-bit systems, replace manual arithmetic with overflow-checked > > helpers (st_mult, st_add, st_add3). > > > > For the unpacked index allocation: > > - sizeof(struct unpacked_index_entry) is 12 bytes on 32-bit systems, > > which may be padded to 16 bytes depending on compiler alignment rules. > > - sizeof(struct index_entry *) is 4 bytes. > > - entries is capped by (0xffffffu / RABIN_WINDOW) where RABIN_WINDOW is 16, > > limiting entries to 1,048,575. > > - hsize is the smallest power of 2 greater than or equal to entries, > > capped at 1,048,576. > > > > While entries is bounded in current code, using st_mult() and st_add() > > guarantees that any unexpected growth in struct sizes or bounds changes > > will safely die() on size_t overflow instead of wrapping around. > > Much more useful for future developers to learn what led to the > conclusion. > > > For the packed index allocation: > > - Passing (hsize + 1) as an argument to st_add3() is safe from overflow > > because hsize is capped at 1,048,576 early in the function. > > hsize+1 is *not* an argument to st_add3(), though. It is given to > st_mult(). Hi Junio, Thank you! I have updated the commit message to correctly note that (hsize + 1) is given to st_mult(), which is evaluated inside st_add3(). Best regards, Srujith