Re: [PATCH] pack-objects: re-validate data we copy from elsewhere.

From: Linus Torvalds <torvalds@osdl.org>
Date: Sep 3, 2006, 22:16 UTC
Message-ID: <Pine.LNX.4.64.0609031510330.27779@g5.osdl.org>
In-Reply-To: <Pine.LNX.4.64.0609031456520.27779@g5.osdl.org>

On Sun, 3 Sep 2006, Linus Torvalds wrote:

Show 5 quoted lines

> 
> Ok. Is it less painful if it just checks the zlib CRC (and that the SHA1 
> _exists_ for a delta - although I guess we check that indirectly by just 
> accepting the delta in the first place)? That combination should still be 
> a fairly strong check, of course.

Thinking some more about it, doing the stupid "apply full delta chain and check the final SHA1" is horribly inefficient, because if you have a repo that packs well, you'd expect to have a lot of things with a 10-deep delta chain.

And doing it the silly way means that you'll do each object independently, ie for a 10-deep chain you'd unpack the base object ten times, and apply the first delta 9 times, the second one 8 times etc etc. And each time you'd deflate everything, since we don't keep a cache of actual object contents.

So I'd expect that with full SHA1 checking, you'd end up doing ~45 deflates for the ten-object chain, instead of doing just 10.

So it should hopefully be _much_ cheaper to just check the zlib CRC, not because the "apply delta" and "calculate sha1" are necessarily all that expensive, but because the unoptimized chain-unpacking is doing so much unnecessary work.

			Linus

-- 
VGER BF report: U 0.5