commit-graph: detect out-of-order BIDX offsets
The BIDX chunk tells us the offsets at which each commit's Bloom filters can be found in the BDAT chunk. We compute the length of each filter by checking the offsets of neighbors and subtracting them. If the offsets are out of order, then we'll get a negative length, which we then store as a very large unsigned value. This can cause us to read out-of-bounds memory, as we access the hash data modulo "filter->len * BITS_PER_WORD". We can easily detect this case when loading the individual filters. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jeff King committed
Oct 9, 2023 at 17:05 UTC
12192a9db9beb3c45dd5064f34d1fcdc71f6a062
2 files changed
+23
bloom.c
+10
@@ -75,6 +75,16 @@ static int load_bloom_filter_from_graph(struct commit_graph *g,
75
check_bloom_offset(g, lex_pos - 1, start_index) < 0)
76
return 0;
77
78
+ if (end_index < start_index) {
79
+ warning("ignoring decreasing changed-path index offsets"
80
+ " (%"PRIuMAX" > %"PRIuMAX") for positions"
81
+ " %"PRIuMAX" and %"PRIuMAX" of %s",
82
+ (uintmax_t)start_index, (uintmax_t)end_index,
83
+ (uintmax_t)(lex_pos-1), (uintmax_t)lex_pos,
84
+ g->filename);
85
+ return 0;
86
+ }
87
+
88
filter->len = end_index - start_index;
89
filter->data = (unsigned char *)(g->chunk_bloom_data +
90
sizeof(unsigned char) * start_index +
t/t4216-log-bloom.sh
+13
@@ -441,4 +441,17 @@ test_expect_success 'Bloom reader notices too-small index chunk' '
441
test_cmp expect.err err
442
'
443
444
+test_expect_success 'Bloom reader notices out-of-order index offsets' '
445
+ # we do not know any real offsets, but we can pick
446
+ # something plausible; we should not get to the point of
447
+ # actually reading from the bogus offsets anyway.
448
+ corrupt_graph BIDX 4 0000000c00000005 &&
449
+ echo "warning: ignoring decreasing changed-path index offsets" \
450
+ "(12 > 5) for positions 1 and 2 of .git/objects/info/commit-graph" >expect.err &&
451
+ git -c core.commitGraph=false log -- A/B/file2 >expect.out &&
452
+ git -c core.commitGraph=true log -- A/B/file2 >out 2>err &&
453
+ test_cmp expect.out out &&
454
+ test_cmp expect.err err
455
+'
456
+
457
test_done