@matheusbsbs / matheus-bagliano / commits / b103881d4f

midx repack: avoid integer overflow on 32 bit systems

On a 32 bit system "git multi-pack-index --repack --batch-size=120M" failed with fatal: size_t overflow: 6038786 * 1289 The calculation to estimated size of the objects in the pack referenced by the multi-pack-index uses st_mult() to multiply the pack size by the number of referenced objects before dividing by the total number of objects in the pack. As size_t is 32 bits on 32 bit systems this calculation easily overflows. Fix this by using 64bit arithmetic instead. Also fix a potential overflow when caluculating the total size of the objects referenced by the multipack index with a batch size larger than SIZE_MAX / 2. In that case total_size += estimated_size can overflow as both total_size and estimated_size can be greater that SIZE_MAX / 2. This is addressed by using saturating arithmetic for the addition. Although estimated_size is of type uint64_t by the time we reach this sum it is bounded by the batch size which is of type size_t and so casting estimated_size to size_t does not truncate the value. Signed-off-by: Phillip Wood <phillip.wood@dunelm.org.uk> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Phillip Wood committed May 22, 2025 at 16:55 UTC b103881d4f4b157d86813ba5f91acd7ed6c888d0

2 files changed +24 -4

git-compat-util.h

+16

@@ -668,6 +668,22 @@ static inline int cast_size_t_to_int(size_t a)

668 return (int)a;

669 }

670

671 +static inline uint64_t u64_mult(uint64_t a, uint64_t b)

672 +{

673 + if (unsigned_mult_overflows(a, b))

674 + die("uint64_t overflow: %"PRIuMAX" * %"PRIuMAX,

675 + (uintmax_t)a, (uintmax_t)b);

676 + return a * b;

677 +}

678 +

679 +static inline uint64_t u64_add(uint64_t a, uint64_t b)

680 +{

681 + if (unsigned_add_overflows(a, b))

682 + die("uint64_t overflow: %"PRIuMAX" + %"PRIuMAX,

683 + (uintmax_t)a, (uintmax_t)b);

684 + return a + b;

685 +}

686 +

687 /*

688 * Limit size of IO chunks, because huge chunks only cause pain. OS X

689 * 64-bit is buggy, returning EINVAL if len >= INT_MAX; and even in

midx-write.c

+8 -4

@@ -1699,19 +1699,23 @@ static void fill_included_packs_batch(struct repository *r,

1699 for (i = 0; total_size < batch_size && i < m->num_packs; i++) {

1700 int pack_int_id = pack_info[i].pack_int_id;

1701 struct packed_git *p = m->packs[pack_int_id];

1702 - size_t expected_size;

1702 + uint64_t expected_size;

1703

1704 if (!want_included_pack(r, m, pack_kept_objects, pack_int_id))

1705 continue;

1706

1707 - expected_size = st_mult(p->pack_size,

1708 - pack_info[i].referenced_objects);

1707 + expected_size = uint64_mult(p->pack_size,

1708 + pack_info[i].referenced_objects);

1709 expected_size /= p->num_objects;

1710

1711 if (expected_size >= batch_size)

1712 continue;

1713

1714 - total_size += expected_size;

1714 + if (unsigned_add_overflows(total_size, (size_t)expected_size))

1715 + total_size = SIZE_MAX;

1716 + else

1717 + total_size += expected_size;

1718 +

1719 include_pack[pack_int_id] = 1;

1720 }

1721