Re: [PATCH] packfile: avoid overflowing shift during decode
- From
Junio C Hamano <gitster@pobox.com>
- Date
- Jan 12, 2022, 20:12 UTC
- Message-ID
- <xmqq4k68u30t.fsf@gitster.g>
- In-Reply-To
- <xmqq8rvku3bq.fsf@gitster.g>
Junio C Hamano <gitster@pobox.com> writes:
Show 29 quoted lines
> Marc Strapetz <marc.strapetz@syntevo.com> writes:
>
>> On 11/11/2021 02:58, Junio C Hamano wrote:
>>> Jonathan Tan <jonathantanmy@google.com> writes:
>>>
>>>> diff --git a/packfile.c b/packfile.c
>>>> index 89402cfc69..972c327e29 100644
>>>> --- a/packfile.c
>>>> +++ b/packfile.c
>>>> @@ -1068,7 +1068,7 @@ unsigned long unpack_object_header_buffer(const unsigned char *buf,
>>>> size = c & 15;
>>>> shift = 4;
>>>> while (c & 0x80) {
>>>> - if (len <= used || bitsizeof(long) <= shift) {
>>>> + if (len <= used || (bitsizeof(long) - 7) <= shift) {
>>
>> This seems to cause troubles now for 32-bit systems (in my case Git
>> for Windows 32-Bit): `shift` will go through 4, 11, 18 and for 25 it
>> finally errors out. This means that objects >= 32MB can't be processed
>> anymore. The condition should probably be changed to:
>>
>> + if (len <= used || (bitsizeof(long) - 7) < shift) {
>>
>> This still ensures that the shift can never overflow and on 32-bit
>> systems restores the maximum size of 4G with a final shift of 127<<25
>> (the old condition `bitsizeof(long) <= shift` was perfectly valid for
>> 32-bit systems).
>
> Jonathan?----- >8 --------- >8 --------- >8 --------- >8 --------- >8 ----- Date: Wed, 12 Jan 2022 12:11:42 -0800 Subject: [PATCH] packfile: fix off-by-one error in decoding logic
shift count being exactly at 7-bit smaller than the long is OK; on 32-bit architecture, shift count starts at 4 and goes through 11, 18 and 25, at which point the guard triggers one iteration too early.
Reported-by: Marc Strapetz <marc.strapetz@syntevo.com> Signed-off-by: Junio C Hamano <gitster@pobox.com> --- packfile.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/packfile.c b/packfile.c index d3820c780b..667e21ce97 100644 --- a/packfile.c +++ b/packfile.c @@ -1067,7 +1067,7 @@ unsigned long unpack_object_header_buffer(const unsigned char *buf, size = c & 15; shift = 4; while (c & 0x80) { - if (len <= used || (bitsizeof(long) - 7) <= shift) { + if (len <= used || (bitsizeof(long) - 7) < shift) { error("bad object header"); size = used = 0; break;
-- 2.35.0-rc0-170-g6a31d082e5