midx: check size of oid lookup chunk
When reading an on-disk multi-pack-index, we take the number of objects in the midx from the final value of the fanout table. But we just blindly assume that the chunk containing the actual oid entries is the correct size. This can lead to us reading out-of-bounds memory if the lookup chunk is too small (or if the fanout is corrupted; when they don't agree we cannot tell which one is wrong). Note that we bump the assignment of m->num_objects into the fanout parser callback, so that it's set when we parse the lookup table (otherwise we'd have to manually record the lookup table size and check it later). Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jeff King committed
Oct 9, 2023 at 17:02 UTC
fc926567ede1f82799ef49dd54aa37b4497a5453
2 files changed
+25
-3
midx.c
+15
-3
@@ -71,6 +71,20 @@ static int midx_read_oid_fanout(const unsigned char *chunk_start,
71
error(_("multi-pack-index OID fanout is of the wrong size"));
72
return 1;
73
}
74
+ m->num_objects = ntohl(m->chunk_oid_fanout[255]);
75
+ return 0;
76
+}
77
+
78
+static int midx_read_oid_lookup(const unsigned char *chunk_start,
79
+ size_t chunk_size, void *data)
80
+{
81
+ struct multi_pack_index *m = data;
82
+ m->chunk_oid_lookup = chunk_start;
83
+
84
+ if (chunk_size != st_mult(m->hash_len, m->num_objects)) {
85
+ error(_("multi-pack-index OID lookup chunk is the wrong size"));
86
+ return 1;
87
+ }
88
return 0;
89
}
90
@@ -147,7 +161,7 @@ struct multi_pack_index *load_multi_pack_index(const char *object_dir, int local
161
die(_("multi-pack-index required pack-name chunk missing or corrupted"));
162
if (read_chunk(cf, MIDX_CHUNKID_OIDFANOUT, midx_read_oid_fanout, m))
163
die(_("multi-pack-index required OID fanout chunk missing or corrupted"));
150
- if (pair_chunk_unsafe(cf, MIDX_CHUNKID_OIDLOOKUP, &m->chunk_oid_lookup))
164
+ if (read_chunk(cf, MIDX_CHUNKID_OIDLOOKUP, midx_read_oid_lookup, m))
165
die(_("multi-pack-index required OID lookup chunk missing or corrupted"));
166
if (pair_chunk_unsafe(cf, MIDX_CHUNKID_OBJECTOFFSETS, &m->chunk_object_offsets))
167
die(_("multi-pack-index required object offsets chunk missing or corrupted"));
@@ -157,8 +171,6 @@ struct multi_pack_index *load_multi_pack_index(const char *object_dir, int local
171
if (git_env_bool("GIT_TEST_MIDX_READ_RIDX", 1))
172
pair_chunk_unsafe(cf, MIDX_CHUNKID_REVINDEX, &m->chunk_revindex);
173
160
- m->num_objects = ntohl(m->chunk_oid_fanout[255]);
161
-
174
CALLOC_ARRAY(m->pack_names, m->num_packs);
175
CALLOC_ARRAY(m->packs, m->num_packs);
176
t/t5319-multi-pack-index.sh
+10
@@ -1073,4 +1073,14 @@ test_expect_success 'reader notices too-small oid fanout chunk' '
1073
test_cmp expect err
1074
'
1075
1076
+test_expect_success 'reader notices too-small oid lookup chunk' '
1077
+ corrupt_chunk OIDL clear 00000000 &&
1078
+ test_must_fail git log 2>err &&
1079
+ cat >expect <<-\EOF &&
1080
+ error: multi-pack-index OID lookup chunk is the wrong size
1081
+ fatal: multi-pack-index required OID lookup chunk missing or corrupted
1082
+ EOF
1083
+ test_cmp expect err
1084
+'
1085
+
1086
test_done