From d8f325563d85abcd9816311b3a84093b2d1cda9f Mon Sep 17 00:00:00 2001 From: Nicolas Pitre Date: Wed, 29 Oct 2008 19:02:45 -0400 Subject: better validation on delta base object offsets In one case, it was possible to have a bad offset equal to 0 effectively pointing a delta onto itself and crashing git after too many recursions. In the other cases, a negative offset could result due to off_t being signed. Catch those. Signed-off-by: Nicolas Pitre Signed-off-by: Junio C Hamano --- index-pack.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'index-pack.c') diff --git a/index-pack.c b/index-pack.c index 6f89bb9ac..da03eeeca 100644 --- a/index-pack.c +++ b/index-pack.c @@ -334,7 +334,7 @@ static void *unpack_raw_entry(struct object_entry *obj, union delta_base *delta_ base_offset = (base_offset << 7) + (c & 127); } delta_base->offset = obj->idx.offset - base_offset; - if (delta_base->offset >= obj->idx.offset) + if (delta_base->offset <= 0 || delta_base->offset >= obj->idx.offset) bad_object(obj->idx.offset, "delta base offset is out of bound"); break; case OBJ_COMMIT: -- cgit v1.2.1