[PATCH v7] diff-delta: use safe integer arithmetic

["Srujith A Poojary via GitGitGadget" <gitgitgadget@gmail.com>]

From: Srujith A Poojary <poojarysrujith@gmail.com>

In create_delta_index(), buffer sizes for allocating the delta index
are calculated using arithmetic operations on entries and hsize:

  memsize = sizeof(*hash) * hsize + sizeof(*entry) * entries

To prevent potential size_t wrap-around when computing allocation sizes
on 32-bit systems, replace manual arithmetic with overflow-checked
helpers (st_mult, st_add, st_add3).

For the unpacked index allocation:
- sizeof(struct unpacked_index_entry) is exactly 16 bytes on 32-bit systems
  (4 bytes for ptr, 4 bytes for val, 4 bytes for inner entry, and 4 bytes
  for the next pointer).
- sizeof(struct index_entry *) is 4 bytes.
- entries is capped by (0xffffffu / RABIN_WINDOW), limiting entries.
- hsize is determined as the smallest power of 2 >= (entries / 4), capped
  appropriately.

Using st_mult() and st_add() guarantees that any allocation calculations
will safely die() on size_t overflow instead of wrapping around.

For the packed index allocation:
- (hsize + 1) is passed to st_mult(), which is evaluated as an argument
  inside st_add3(), and is safe from overflow because hsize is capped early
  in the function.

Signed-off-by: Srujith A Poojary <poojarysrujith@gmail.com>
---
    [Outreachy PATCH] diff-delta: use safe integer arithmetic

Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-2276%2Fpoojarysrujith%2Fc-refactor-target-name-v7
Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-2276/poojarysrujith/c-refactor-target-name-v7
Pull-Request: https://github.com/gitgitgadget/git/pull/2276

Range-diff vs v6:

 1:  b91a1ed54b ! 1:  8eb6d31788 diff-delta: use safe integer arithmetic
     @@ Commit message
          helpers (st_mult, st_add, st_add3).
      
          For the unpacked index allocation:
     -    - sizeof(struct unpacked_index_entry) is 12 bytes on 32-bit systems,
     -      which may be padded to 16 bytes depending on compiler alignment rules.
     +    - sizeof(struct unpacked_index_entry) is exactly 16 bytes on 32-bit systems
     +      (4 bytes for ptr, 4 bytes for val, 4 bytes for inner entry, and 4 bytes
     +      for the next pointer).
          - sizeof(struct index_entry *) is 4 bytes.
     -    - entries is capped by (0xffffffu / RABIN_WINDOW) where RABIN_WINDOW is 16,
     -      limiting entries to 1,048,575.
     -    - hsize is the smallest power of 2 greater than or equal to entries,
     -      capped at 1,048,576.
     +    - entries is capped by (0xffffffu / RABIN_WINDOW), limiting entries.
     +    - hsize is determined as the smallest power of 2 >= (entries / 4), capped
     +      appropriately.
      
     -    While entries is bounded in current code, using st_mult() and st_add()
     -    guarantees that any unexpected growth in struct sizes or bounds changes
     +    Using st_mult() and st_add() guarantees that any allocation calculations
          will safely die() on size_t overflow instead of wrapping around.
      
          For the packed index allocation:
          - (hsize + 1) is passed to st_mult(), which is evaluated as an argument
     -      inside st_add3(), and is safe from overflow because hsize is capped at
     -      1,048,576 early in the function.
     +      inside st_add3(), and is safe from overflow because hsize is capped early
     +      in the function.
      
          Signed-off-by: Srujith A Poojary <poojarysrujith@gmail.com>
      


 diff-delta.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/diff-delta.c b/diff-delta.c
index 7cbedeb507..efebce3aca 100644
--- a/diff-delta.c
+++ b/diff-delta.c
@@ -162,8 +162,8 @@ struct delta_index * create_delta_index(const void *buf, size_t bufsize)
 	hmask = hsize - 1;
 
 	/* allocate lookup index */
-	memsize = sizeof(*hash) * hsize +
-		  sizeof(*entry) * entries;
+	memsize = st_add(st_mult(sizeof(*hash), hsize),
+			 st_mult(sizeof(*entry), entries));
 	mem = malloc(memsize);
 	if (!mem)
 		return NULL;
@@ -258,9 +258,9 @@ struct delta_index * create_delta_index(const void *buf, size_t bufsize)
 	 * Now create the packed index in array form
 	 * rather than linked lists.
 	 */
-	memsize = sizeof(*index)
-		+ sizeof(*packed_hash) * (hsize+1)
-		+ sizeof(*packed_entry) * entries;
+	memsize = st_add3(sizeof(*index),
+			  st_mult(sizeof(*packed_hash), hsize + 1),
+			  st_mult(sizeof(*packed_entry), entries));
 	mem = malloc(memsize);
 	if (!mem) {
 		free(hash);

base-commit: 47fdf2208c5b94c8cc01c106b8f7c85efb91c926
-- 
gitgitgadget