mirror of
https://github.com/git/git
synced 2024-10-02 14:45:21 +00:00
midx: check size of object offset chunk
The object offset chunk has one fixed-size entry for each object in the midx. But since we don't check its size, we may access out-of-bounds memory if we see a corrupt or malicious midx file. Sine the entries are fixed-size, the total length can be known up-front, and we can just check it while parsing the chunk (this is similar to what we do when opening pack idx files, which contain a similar offset table). Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
parent
c9b9fefc13
commit
0924869b4e
15
midx.c
15
midx.c
|
@ -88,6 +88,19 @@ static int midx_read_oid_lookup(const unsigned char *chunk_start,
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static int midx_read_object_offsets(const unsigned char *chunk_start,
|
||||||
|
size_t chunk_size, void *data)
|
||||||
|
{
|
||||||
|
struct multi_pack_index *m = data;
|
||||||
|
m->chunk_object_offsets = chunk_start;
|
||||||
|
|
||||||
|
if (chunk_size != st_mult(m->num_objects, MIDX_CHUNK_OFFSET_WIDTH)) {
|
||||||
|
error(_("multi-pack-index object offset chunk is the wrong size"));
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
struct multi_pack_index *load_multi_pack_index(const char *object_dir, int local)
|
struct multi_pack_index *load_multi_pack_index(const char *object_dir, int local)
|
||||||
{
|
{
|
||||||
struct multi_pack_index *m = NULL;
|
struct multi_pack_index *m = NULL;
|
||||||
|
@ -164,7 +177,7 @@ struct multi_pack_index *load_multi_pack_index(const char *object_dir, int local
|
||||||
die(_("multi-pack-index required OID fanout chunk missing or corrupted"));
|
die(_("multi-pack-index required OID fanout chunk missing or corrupted"));
|
||||||
if (read_chunk(cf, MIDX_CHUNKID_OIDLOOKUP, midx_read_oid_lookup, m))
|
if (read_chunk(cf, MIDX_CHUNKID_OIDLOOKUP, midx_read_oid_lookup, m))
|
||||||
die(_("multi-pack-index required OID lookup chunk missing or corrupted"));
|
die(_("multi-pack-index required OID lookup chunk missing or corrupted"));
|
||||||
if (pair_chunk_unsafe(cf, MIDX_CHUNKID_OBJECTOFFSETS, &m->chunk_object_offsets))
|
if (read_chunk(cf, MIDX_CHUNKID_OBJECTOFFSETS, midx_read_object_offsets, m))
|
||||||
die(_("multi-pack-index required object offsets chunk missing or corrupted"));
|
die(_("multi-pack-index required object offsets chunk missing or corrupted"));
|
||||||
|
|
||||||
pair_chunk_unsafe(cf, MIDX_CHUNKID_LARGEOFFSETS, &m->chunk_large_offsets);
|
pair_chunk_unsafe(cf, MIDX_CHUNKID_LARGEOFFSETS, &m->chunk_large_offsets);
|
||||||
|
|
|
@ -1108,4 +1108,14 @@ test_expect_success 'reader handles unaligned chunks' '
|
||||||
test_cmp expect.err err
|
test_cmp expect.err err
|
||||||
'
|
'
|
||||||
|
|
||||||
|
test_expect_success 'reader notices too-small object offset chunk' '
|
||||||
|
corrupt_chunk OOFF clear 00000000 &&
|
||||||
|
test_must_fail git log 2>err &&
|
||||||
|
cat >expect <<-\EOF &&
|
||||||
|
error: multi-pack-index object offset chunk is the wrong size
|
||||||
|
fatal: multi-pack-index required object offsets chunk missing or corrupted
|
||||||
|
EOF
|
||||||
|
test_cmp expect err
|
||||||
|
'
|
||||||
|
|
||||||
test_done
|
test_done
|
||||||
|
|
Loading…
Reference in a new issue