Re: [PATCH 5/5] packfile: detect overflow in .idx file size checks
- From
Johannes Schindelin <johannes.schindelin@gmx.de>
- Date
- Nov 13, 2020, 11:02 UTC
- Message-ID
- <nycvar.QRO.7.76.6.2011131200460.18437@tvgsbejvaqbjf.bet>
- In-Reply-To
- <20201113050719.GE744691@coredump.intra.peff.net>
Hi Peff,
On Fri, 13 Nov 2020, Jeff King wrote:
Show 23 quoted lines
> diff --git a/packfile.c b/packfile.c
> index 63fe9ee8be..9702b1218b 100644
> --- a/packfile.c
> +++ b/packfile.c
> @@ -148,7 +148,7 @@ int load_idx(const char *path, const unsigned int hashsz, void *idx_map,
> * - hash of the packfile
> * - file checksum
> */
> - if (idx_size != 4 * 256 + (size_t)nr * (hashsz + 4) + hashsz + hashsz)
> + if (idx_size != st_add(4 * 256 + hashsz + hashsz, st_mult(nr, hashsz + 4)))
> return error("wrong index v1 file size in %s", path);
> } else if (version == 2) {
> /*
> @@ -164,10 +164,10 @@ int load_idx(const char *path, const unsigned int hashsz, void *idx_map,
> * variable sized table containing 8-byte entries
> * for offsets larger than 2^31.
> */
> - size_t min_size = 8 + 4*256 + (size_t)nr*(hashsz + 4 + 4) + hashsz + hashsz;
> + size_t min_size = st_add(8 + 4*256 + hashsz + hashsz, st_mult(nr, hashsz + 4 + 4));
> size_t max_size = min_size;
> if (nr)
> - max_size += ((size_t)nr - 1)*8;
> + max_size = st_add(max_size, st_mult(nr - 1, 8));I wondered about these multiplications and whether we should use the `st_*()` helpers, when reading 1/5. And I am glad I read on!
FWIW I like all five patches.
Thanks, Dscho
Show 6 quoted lines
> if (idx_size < min_size || idx_size > max_size)
> return error("wrong index v2 file size in %s", path);
> if (idx_size != min_size &&
> --
> 2.29.2.705.g306f91dc4e
>