@matheusbsbs / matheus-bagliano / commits / 61b0fcbb64

midx: double-check large object write loop

The write_midx_large_offsets() function takes an array of object entries, the number of entries in the array (nr_objects), and the number of entries with large offsets (nr_large_offset). But we never actually use nr_objects; instead we keep walking down the array and counting down nr_large_offset until we've seen all of the large entries. This is correct, but we can be a bit more defensive. If there were ever a mismatch between nr_large_offset and the actual set of large-offset objects, we'd walk off the end of the array. Since we know the size of the array, we can use nr_objects to make sure we don't walk too far. Signed-off-by: Jeff King <peff@peff.net> Reviewed-by: Derrick Stolee <dstolee@microsoft.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Jeff King committed Nov 3, 2018 at 22:27 UTC 61b0fcbb64d00d52290d433c1e754c01740b3d19

1 file changed +9 -3

midx.c

+9 -3

@@ -712,12 +712,18 @@ static size_t write_midx_object_offsets(struct hashfile *f, int large_offset_nee

712 static size_t write_midx_large_offsets(struct hashfile *f, uint32_t nr_large_offset,

713 struct pack_midx_entry *objects, uint32_t nr_objects)

714 {

715 - struct pack_midx_entry *list = objects;

715 + struct pack_midx_entry *list = objects, *end = objects + nr_objects;

716 size_t written = 0;

717

718 while (nr_large_offset) {

719 - struct pack_midx_entry *obj = list++;

720 - uint64_t offset = obj->offset;

719 + struct pack_midx_entry *obj;

720 + uint64_t offset;

721 +

722 + if (list >= end)

723 + BUG("too many large-offset objects");

724 +

725 + obj = list++;

726 + offset = obj->offset;

727

728 if (!(offset >> 31))

729 continue;