Re: Segmentation fault found while fuzzing .pack file under 2.7.0.rc3

[Jeff King <peff@peff.net>]

On Thu, Jan 07, 2016 at 02:54:50PM -0800, Junio C Hamano wrote:

> We do not check if the offset of individual objects are within the
> corresponding .pack file, either, and nth_packed_object_offset()
> does return the data read from .idx file that is not checked for
> sanity.  use_pack(), which is the helper used by the callers of
> nth_packed_object_offset() that finds the offset in the packfile for
> each object, avoids allowing a read access to mapped pack data
> beyond the end of it, so it is OK to return bogus value that was
> read from the .idx file from this function, but there is one
> computation the function itself does using a possibly bogus value
> read from the disk: to find out where in the secondary offset table
> in the .idx file the offset in the packfile is stored.

Looks like this topic got dropped. I was reminded of it when somebody
pointed me to a similar case[1] today which segfaults in a similar way (but
this time was caused by actual filesystem corruption).

Did you ever push the patch below further along?

I confirmed that your patch detects and complains on this newer case.
Though I think there is another similar problem in
read_v2_anomalous_offsets (I haven't dug, but it triggers for me in
"index-pack --verify").

-Peff

[1] https://github.com/libgit2/libgit2/issues/3556