index-pack, unpack-objects: use get_be32() for reading pack header

Both of these commands read the incoming pack into a static unsigned char buffer in BSS, and then parse it by casting the start of the buffer to a struct pack_header. This can result in SIGBUS on some platforms if the compiler doesn't place the buffer in a position that is properly aligned for 4-byte integers. This reportedly happens with unpack-objects (but not index-pack) on sparc64 when compiled with clang (but not gcc). But we are definitely in the wrong in both spots; since the buffer's type is unsigned char, we can't depend on larger alignment. When it works it is only because we are lucky. We'll fix this by switching to get_be32() to read the headers (just like the last few commits similarly switched us to put_be32() for writing into the same buffer). It would be nice to factor this out into a common helper function, but the interface ends up quite awkward. Either the caller needs to hardcode how many bytes we'll need, or it needs to pass us its fill()/use() functions as pointers. So I've just fixed both spots in the same way; this is not code that is likely to be repeated a third time (most of the pack reading code uses an mmap'd buffer, which should be properly aligned). I did make one tweak to the shared code: our pack_version_ok() macro expects us to pass the big-endian value we'd get by casting. We can introduce a "native" variant which uses the host integer ordering. Reported-by: Koakuma <koachan@protonmail.com> Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Jeff King committed Jan 19, 2025 at 08:25 UTC f1299bff26a20b70bb5b8440526a2bd3c6de298a
3 files changed +16 -12
builtin/index-pack.c
+7 -5
@@ -363,16 +363,18 @@ static const char *open_pack_file(const char *pack_name)
363
364 static void parse_pack_header(void)
365 {
366 - struct pack_header *hdr = fill(sizeof(struct pack_header));
366 + unsigned char *hdr = fill(sizeof(struct pack_header));
367
368 /* Header consistency check */
369 - if (hdr->hdr_signature != htonl(PACK_SIGNATURE))
369 + if (get_be32(hdr) != PACK_SIGNATURE)
370 die(_("pack signature mismatch"));
371 - if (!pack_version_ok(hdr->hdr_version))
371 + hdr += 4;
372 + if (!pack_version_ok_native(get_be32(hdr)))
373 die(_("pack version %"PRIu32" unsupported"),
373 - ntohl(hdr->hdr_version));
374 + get_be32(hdr));
375 + hdr += 4;
376
375 - nr_objects = ntohl(hdr->hdr_entries);
377 + nr_objects = get_be32(hdr);
378 use(sizeof(struct pack_header));
379 }
380
builtin/unpack-objects.c
+7 -6
@@ -576,15 +576,16 @@ static void unpack_one(unsigned nr)
576 static void unpack_all(void)
577 {
578 int i;
579 - struct pack_header *hdr = fill(sizeof(struct pack_header));
579 + unsigned char *hdr = fill(sizeof(struct pack_header));
580
581 - nr_objects = ntohl(hdr->hdr_entries);
582 -
583 - if (ntohl(hdr->hdr_signature) != PACK_SIGNATURE)
581 + if (get_be32(hdr) != PACK_SIGNATURE)
582 die("bad pack file");
585 - if (!pack_version_ok(hdr->hdr_version))
583 + hdr += 4;
584 + if (!pack_version_ok_native(get_be32(hdr)))
585 die("unknown pack file version %"PRIu32,
587 - ntohl(hdr->hdr_version));
586 + get_be32(hdr));
587 + hdr += 4;
588 + nr_objects = get_be32(hdr);
589 use(sizeof(struct pack_header));
590
591 if (!quiet)
pack.h
+2 -1
@@ -13,7 +13,8 @@ struct repository;
13 */
14 #define PACK_SIGNATURE 0x5041434b /* "PACK" */
15 #define PACK_VERSION 2
16 -#define pack_version_ok(v) ((v) == htonl(2) || (v) == htonl(3))
16 +#define pack_version_ok(v) pack_version_ok_native(ntohl(v))
17 +#define pack_version_ok_native(v) ((v) == 2 || (v) == 3)
18 struct pack_header {
19 uint32_t hdr_signature;
20 uint32_t hdr_version;