From: Martin Koegler <martin.koegler@chello.at>
To: Junio C Hamano <gitster@pobox.com>
Cc: Martin Koegler <martin.koegler@chello.at>,
git@vger.kernel.org, Johannes.Schindelin@gmx.de
Subject: Re: [PATCH 4/4] Fix delta offset overflow
Date: Fri, 11 Aug 2017 08:57:32 +0200 [thread overview]
Message-ID: <20170811065732.GA15128@mail.zuhause> (raw)
In-Reply-To: <xmqqbmnn2lnv.fsf@gitster.mtv.corp.google.com>
On Thu, Aug 10, 2017 at 01:49:24PM -0700, Junio C Hamano wrote:
> The lower 4-byte of moff (before incrementing it with msize) were
> already encoded to the output stream before this hunk. Shouldn't
> we be checking if moff would fit in uint32_t _before_ that happens?
moff is otherwise only decremented or assigned with an offset generated by
create_delta_index. These offsets are limited by 4GB.
Any larger offets would be a programming bug - so qualify for just a "assert".
> IOW, in a much earlier part of that "while (data < top)" loop, there
> is a code that tries to find a match that gives us a large msize by
> iterating over index->hash[], and it sets msize and moff as a potential
> location that we may want to use. If moff is already big there, then
> we shouldn't consider it a match because we cannot encode its location
> using 4-byte anyway, no?
Recovering from an incorrect moff would add more complex code for a case, that
should not happen. A bailout would be sufficient.
> Cutting it off at here by resetting msize to 0 might help the next
> iteration (I didn't check, but is the effect of it is to corrupt the
> "val" rolling checksum and make it unlikely that the hash
> computation would not find a correct match?) but it somehow feels
> like closing the barn door after the horse has already bolted...
The current code produces incorrect deltas - its not just a checksum issue.
By the way:
Somebody interested in JGIT should also look at these two bugs:
https://github.com/eclipse/jgit/blob/005e5feb4ecd08c4e4d141a38b9e7942accb3212/org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/pack/DeltaEncoder.java
copy would also encode beyond 4GB - producing truncated delta offset.
https://github.com/eclipse/jgit/blob/005e5feb4ecd08c4e4d141a38b9e7942accb3212/org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/pack/BinaryDelta.java
apply uses int for decoding length values.
Regards,
Martin
next prev parent reply other threads:[~2017-08-11 6:58 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-08-10 18:13 [PATCH 3/4] Convert zlib.c to size_t Martin Koegler
2017-08-10 18:13 ` [PATCH 4/4] Fix delta offset overflow Martin Koegler
2017-08-10 20:49 ` Junio C Hamano
2017-08-11 6:57 ` Martin Koegler [this message]
2017-08-11 18:50 ` Junio C Hamano
2017-08-10 21:52 ` [PATCH 3/4] Convert zlib.c to size_t Junio C Hamano
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170811065732.GA15128@mail.zuhause \
--to=martin.koegler@chello.at \
--cc=Johannes.Schindelin@gmx.de \
--cc=git@vger.kernel.org \
--cc=gitster@pobox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).