packfile: fix off-by-one error in decoding logic
shift count being exactly at 7-bit smaller than the long is OK; on 32-bit architecture, shift count starts at 4 and goes through 11, 18 and 25, at which point the guard triggers one iteration too early. Reported-by: Marc Strapetz <marc.strapetz@syntevo.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Junio C Hamano committed
Jan 12, 2022 at 12:11 UTC
a5c97b016421a2869b460bbf6bdcd43dc186d433
1 file changed
+1
-1
packfile.c
+1
-1
@@ -1067,7 +1067,7 @@ unsigned long unpack_object_header_buffer(const unsigned char *buf,
1067
size = c & 15;
1068
shift = 4;
1069
while (c & 0x80) {
1070
- if (len <= used || (bitsizeof(long) - 7) <= shift) {
1070
+ if (len <= used || (bitsizeof(long) - 7) < shift) {
1071
error("bad object header");
1072
size = used = 0;
1073
break;