Re: [PATCH 09/23] pack v4: commit object encoding

From: Duy Nguyen <pclouds@gmail.com>
Date: Sep 2, 2013, 20:48 UTC
Message-ID: <CACsJy8CnSyw2ae5BS87S8Hid51JVFB3gyLzX+5czwio+C=-VRQ@mail.gmail.com>
In-Reply-To: <1377577567-27655-10-git-send-email-nico@fluxnic.net>

On Tue, Aug 27, 2013 at 11:25 AM, Nicolas Pitre <nico@fluxnic.net> wrote:

Show 11 quoted lines

> This goes as follows:
>
> - Tree reference: either variable length encoding of the index
>   into the SHA1 table or the literal SHA1 prefixed by 0 (see
>   add_sha1_ref()).
>
> - Parent count: variable length encoding of the number of parents.
>   This is normally going to occupy a single byte but doesn't have to.
>
> - List of parent references: a list of add_sha1_ref() encoded references,
>   or nothing if the parent count was zero.

With .pack v3 it's impossible to create delta cycles (3b910d0 add tests for indexing packs with delta cycles - 2013-08-23) but it is possible with .pack v4 (and therefore at least index-pack needs to detect and reject them), correct? Some malicious user can create commit A with parent ref 1, then make the SHA-1 table so that ref 1 is A. The same with the new tree representation.

-- 
Duy