packfile: avoid overflowing shift during decode
unpack_object_header_buffer() attempts to protect against overflowing left shifts, but the limit of the shift amount should not be the size of the variable being shifted. It should be the size minus the size of its contents. Fix that accordingly. This was noticed at $DAYJOB by a fuzzer running internally. Signed-off-by: Jonathan Tan <jonathantanmy@google.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jonathan Tan committed
Nov 10, 2021 at 15:40 UTC
34de5b8eac2743497bc1785f661b4184adce21f3
1 file changed
+1
-1
packfile.c
+1
-1
@@ -1067,7 +1067,7 @@ unsigned long unpack_object_header_buffer(const unsigned char *buf,
1067
size = c & 15;
1068
shift = 4;
1069
while (c & 0x80) {
1070
- if (len <= used || bitsizeof(long) <= shift) {
1070
+ if (len <= used || (bitsizeof(long) - 7) <= shift) {
1071
error("bad object header");
1072
size = used = 0;
1073
break;