mirror of
https://github.com/git/git
synced 2024-08-24 18:26:02 +00:00
Merge branch 'maint'
* maint: sha1_file: Fix infinite loop when pack is corrupted
This commit is contained in:
commit
695f9523dd
|
@ -1357,6 +1357,8 @@ unsigned long get_size_from_delta(struct packed_git *p,
|
|||
in = use_pack(p, w_curs, curpos, &stream.avail_in);
|
||||
stream.next_in = in;
|
||||
st = git_inflate(&stream, Z_FINISH);
|
||||
if (st == Z_BUF_ERROR && (stream.avail_in || !stream.avail_out))
|
||||
break;
|
||||
curpos += stream.next_in - in;
|
||||
} while ((st == Z_OK || st == Z_BUF_ERROR) &&
|
||||
stream.total_out < sizeof(delta_head));
|
||||
|
@ -1594,6 +1596,8 @@ static void *unpack_compressed_entry(struct packed_git *p,
|
|||
in = use_pack(p, w_curs, curpos, &stream.avail_in);
|
||||
stream.next_in = in;
|
||||
st = git_inflate(&stream, Z_FINISH);
|
||||
if (st == Z_BUF_ERROR && (stream.avail_in || !stream.avail_out))
|
||||
break;
|
||||
curpos += stream.next_in - in;
|
||||
} while (st == Z_OK || st == Z_BUF_ERROR);
|
||||
git_inflate_end(&stream);
|
||||
|
|
|
@ -275,4 +275,13 @@ test_expect_success \
|
|||
git cat-file blob $blob_2 > /dev/null &&
|
||||
git cat-file blob $blob_3 > /dev/null'
|
||||
|
||||
test_expect_success \
|
||||
'corrupting header to have too small output buffer fails unpack' \
|
||||
'create_new_pack &&
|
||||
git prune-packed &&
|
||||
printf "\262\001" | do_corrupt_object $blob_1 0 &&
|
||||
test_must_fail git cat-file blob $blob_1 > /dev/null &&
|
||||
test_must_fail git cat-file blob $blob_2 > /dev/null &&
|
||||
test_must_fail git cat-file blob $blob_3 > /dev/null'
|
||||
|
||||
test_done
|
||||
|
|
Loading…
Reference in a new issue