commit-graph: check size of generations chunk
We neither check nor record the size of the generations chunk we parse from a commit-graph file. This should have one uint32_t for each commit in the file; if it is smaller (due to corruption, etc), we may read outside the mapped memory. The included test segfaults without this patch, as it shrinks the size considerably (and the chunk is near the end of the file, so we read off the end of the array rather than accidentally reading another chunk). We can fix this by checking the size up front (like we do for other fixed-size chunks, like CDAT). Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jeff King committed
Oct 9, 2023 at 17:05 UTC
4a3c34662bc56a0e2369635536ac2ee1e79d8f56
2 files changed
+20
-2
commit-graph.c
+12
-2
@@ -350,6 +350,16 @@ static int graph_read_commit_data(const unsigned char *chunk_start,
350
return 0;
351
}
352
353
+static int graph_read_generation_data(const unsigned char *chunk_start,
354
+ size_t chunk_size, void *data)
355
+{
356
+ struct commit_graph *g = data;
357
+ if (chunk_size != g->num_commits * sizeof(uint32_t))
358
+ return error("commit-graph generations chunk is wrong size");
359
+ g->chunk_generation_data = chunk_start;
360
+ return 0;
361
+}
362
+
363
static int graph_read_bloom_data(const unsigned char *chunk_start,
364
size_t chunk_size, void *data)
365
{
@@ -439,8 +449,8 @@ struct commit_graph *parse_commit_graph(struct repo_settings *s,
449
&graph->chunk_base_graphs_size);
450
451
if (s->commit_graph_generation_version >= 2) {
442
- pair_chunk_unsafe(cf, GRAPH_CHUNKID_GENERATION_DATA,
443
- &graph->chunk_generation_data);
452
+ read_chunk(cf, GRAPH_CHUNKID_GENERATION_DATA,
453
+ graph_read_generation_data, graph);
454
pair_chunk_unsafe(cf, GRAPH_CHUNKID_GENERATION_DATA_OVERFLOW,
455
&graph->chunk_generation_data_overflow);
456
t/t5318-commit-graph.sh
+8
@@ -887,4 +887,12 @@ test_expect_success 'reader notices out-of-bounds extra edge' '
887
test_cmp expect.err err
888
'
889
890
+test_expect_success 'reader notices too-small generations chunk' '
891
+ check_corrupt_chunk GDA2 clear 00000000 &&
892
+ cat >expect.err <<-\EOF &&
893
+ error: commit-graph generations chunk is wrong size
894
+ EOF
895
+ test_cmp expect.err err
896
+'
897
+
898
test_done