From: Junio C Hamano <gitster@pobox.com>
Date: Thu, 13 Jul 2023 16:14:05 GMT
Subject: Re: [PATCH 02/20] packfile.c: prevent overflow in `load_idx()`
Message-ID: <xmqqttu7rdpu.fsf@gitster.g>
In-Reply-To: <5d2cf09f-34c7-9a88-bab2-8bf348dd13bb@gmail.com>

Phillip Wood <phillip.wood123@gmail.com> writes:

>> -		p->crc_offset = 8 + 4 * 256 + nr * hashsz;
>> +		p->crc_offset = st_add(8 + 4 * 256, st_mult(nr, hashsz));
>
> p->crc_offset is a uint32_t so we're still prone to truncation here

Good eyes.  Thanks.