Re: [PATCH v5] diff-delta: use safe integer arithmetic

From: Junio C Hamano <gitster@pobox.com>
Date: Oct 26, 2026, 17:37 UTC
Message-ID: <xmqqpkwwqs6i.fsf@gitster.g>
In-Reply-To: <pull.2276.v5.git.1792956031588.gitgitgadget@gmail.com>

"Srujith A Poojary via GitGitGadget" <gitgitgadget@gmail.com> writes:

Show 23 quoted lines

> From: Srujith A Poojary <poojarysrujith@gmail.com>
>
> In create_delta_index(), buffer sizes for allocating the delta index
> are calculated using arithmetic operations on entries and hsize:
>
>   memsize = sizeof(*hash) * hsize + sizeof(*entry) * entries
>
> To prevent potential size_t wrap-around when computing allocation sizes
> on 32-bit systems, replace manual arithmetic with overflow-checked
> helpers (st_mult, st_add, st_add3).
>
> For the unpacked index allocation:
> - sizeof(struct unpacked_index_entry) is 12 bytes on 32-bit systems,
>   which may be padded to 16 bytes depending on compiler alignment rules.
> - sizeof(struct index_entry *) is 4 bytes.
> - entries is capped by (0xffffffu / RABIN_WINDOW) where RABIN_WINDOW is 16,
>   limiting entries to 1,048,575.
> - hsize is the smallest power of 2 greater than or equal to entries,
>   capped at 1,048,576.
>
> While entries is bounded in current code, using st_mult() and st_add()
> guarantees that any unexpected growth in struct sizes or bounds changes
> will safely die() on size_t overflow instead of wrapping around.

Much more useful for future developers to learn what led to the conclusion.

> For the packed index allocation:
> - Passing (hsize + 1) as an argument to st_add3() is safe from overflow
>   because hsize is capped at 1,048,576 early in the function.

hsize+1 is *not* an argument to st_add3(), though. It is given to st_mult().