packed_object_info_detail(): check for corrupt packfile.

Serge E. Hallyn noticed that we compute how many input bytes are
still left, but did not use it for sanity checking.

Signed-off-by: Junio C Hamano <junkio@cox.net>

diff --git a/sha1_file.c b/sha1_file.c
index e3d011309a610ad2b81eeabe810e3844e946734b..f2d33afb27f6c73ad6c177098fe2f2674add7fbe 100644 (file)
--- a/sha1_file.c
+++ b/sha1_file.c
@@ -874,17 +874,19 @@ void packed_object_info_detail(struct pack_entry *e,
                               unsigned char *base_sha1)
 {
        struct packed_git *p = e->p;
-       unsigned long offset, left;
+       unsigned long offset;
        unsigned char *pack;
        enum object_type kind;
 
        offset = unpack_object_header(p, e->offset, &kind, size);
        pack = p->pack_base + offset;
-       left = p->pack_size - offset;
        if (kind != OBJ_DELTA)
                *delta_chain_length = 0;
        else {
                unsigned int chain_length = 0;
+               if (p->pack_size <= offset + 20)
+                       die("pack file %s records an incomplete delta base",
+                           p->pack_name);
                memcpy(base_sha1, pack, 20);
                do {
                        struct pack_entry base_ent;