averello/git-mirror
1
0
Fork 0
mirror of https://github.com/git/git.git synced 2025-12-12 20:36:24 +01:00
Code Issues Packages Projects Releases Wiki Activity

commit-graph: detect out-of-order BIDX offsets

Browse Source 
The BIDX chunk tells us the offsets at which each commit's Bloom filters
can be found in the BDAT chunk. We compute the length of each filter by
checking the offsets of neighbors and subtracting them.

If the offsets are out of order, then we'll get a negative length, which
we then store as a very large unsigned value. This can cause us to read
out-of-bounds memory, as we access the hash data modulo "filter->len *
BITS_PER_WORD".

We can easily detect this case when loading the individual filters.

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
Jeff King
2023-10-09 17:05:56 -04:00
committed by Junio C Hamano
parent 581e0f8b18
commit 12192a9db9
2 changed files with 23 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
bloom.c
View File

@@ -75,6 +75,16 @@ static int load_bloom_filter_from_graph(struct commit_graph *g,
check_bloom_offset(g, lex_pos - 1, start_index) < 0)
return 0;
if (end_index < start_index) {
warning("ignoring decreasing changed-path index offsets"
" (%"PRIuMAX" > %"PRIuMAX") for positions"
" %"PRIuMAX" and %"PRIuMAX" of %s",
(uintmax_t)start_index, (uintmax_t)end_index,
(uintmax_t)(lex_pos-1), (uintmax_t)lex_pos,
g->filename);
return 0;
}
filter->len = end_index - start_index;
filter->data = (unsigned char *)(g->chunk_bloom_data +
sizeof(unsigned char) * start_index +