mirror of
https://github.com/git/git
synced 2024-08-25 02:35:46 +00:00
Merge branch 'jt/pack-header-lshift-overflow'
The code to decode the length of packed object size has been corrected. * jt/pack-header-lshift-overflow: packfile: avoid overflowing shift during decode
This commit is contained in:
commit
2d5b70de2d
|
@ -1068,7 +1068,7 @@ unsigned long unpack_object_header_buffer(const unsigned char *buf,
|
|||
size = c & 15;
|
||||
shift = 4;
|
||||
while (c & 0x80) {
|
||||
if (len <= used || bitsizeof(long) <= shift) {
|
||||
if (len <= used || (bitsizeof(long) - 7) <= shift) {
|
||||
error("bad object header");
|
||||
size = used = 0;
|
||||
break;
|
||||
|
|
Loading…
Reference in a new issue