From: Junio C Hamano <junkio@cox.net>
Date: Tue, 18 Apr 2006 00:46:07 +0000 (-0700)
Subject: packed_object_info_detail(): check for corrupt packfile.
X-Git-Tag: v1.3.0~4
X-Git-Url: https://git.tokkee.org/?a=commitdiff_plain;h=2855d58079cd56361879cc03f7c769409bb445e5;p=git.git

packed_object_info_detail(): check for corrupt packfile.

Serge E. Hallyn noticed that we compute how many input bytes are
still left, but did not use it for sanity checking.

Signed-off-by: Junio C Hamano <junkio@cox.net>
---

diff --git a/sha1_file.c b/sha1_file.c
index e3d011309..f2d33afb2 100644
--- a/sha1_file.c
+++ b/sha1_file.c
@@ -874,17 +874,19 @@ void packed_object_info_detail(struct pack_entry *e,
 			       unsigned char *base_sha1)
 {
 	struct packed_git *p = e->p;
-	unsigned long offset, left;
+	unsigned long offset;
 	unsigned char *pack;
 	enum object_type kind;
 
 	offset = unpack_object_header(p, e->offset, &kind, size);
 	pack = p->pack_base + offset;
-	left = p->pack_size - offset;
 	if (kind != OBJ_DELTA)
 		*delta_chain_length = 0;
 	else {
 		unsigned int chain_length = 0;
+		if (p->pack_size <= offset + 20)
+			die("pack file %s records an incomplete delta base",
+			    p->pack_name);
 		memcpy(base_sha1, pack, 20);
 		do {
 			struct pack_entry base_ent;