From: Junio C Hamano <gitster@pobox.com>
Date: Wed, 24 Feb 2016 18:48:27 GMT
Subject: Re: Segmentation fault found while fuzzing .pack file under 2.7.0.rc3
Message-ID: <xmqqegc2t05g.fsf@gitster.mtv.corp.google.com>
In-Reply-To: <20160224110548.GA21620@sigill.intra.peff.net>

Jeff King <peff@peff.net> writes:

> On Thu, Jan 07, 2016 at 02:54:50PM -0800, Junio C Hamano wrote:
>
>> We do not check if the offset of individual objects are within the
>> corresponding .pack file, either, and nth_packed_object_offset()
>> does return the data read from .idx file that is not checked for
>> sanity.  use_pack(), which is the helper used by the callers of
>> nth_packed_object_offset() that finds the offset in the packfile for
>> each object, avoids allowing a read access to mapped pack data
>> beyond the end of it, so it is OK to return bogus value that was
>> read from the .idx file from this function, but there is one
>> computation the function itself does using a possibly bogus value
>> read from the disk: to find out where in the secondary offset table
>> in the .idx file the offset in the packfile is stored.
>
> Looks like this topic got dropped. I was reminded of it when somebody
> pointed me to a similar case[1] today which segfaults in a similar way (but
> this time was caused by actual filesystem corruption).
>
> Did you ever push the patch below further along?

I do not think so, as I didn't "dig"; I recall trying to be explicit
that it was an illustration to prevent two extra and unnecessary
changes I alluded to in the earlier parts of the thread, not a real
patch.

> I confirmed that your patch detects and complains on this newer case.
> Though I think there is another similar problem in
> read_v2_anomalous_offsets (I haven't dug, but it triggers for me in
> "index-pack --verify").
>
> -Peff
>
> [1] https://github.com/libgit2/libgit2/issues/3556