kernel
/
git
mirror of https://git.kernel.org/pub/scm/git/git.git
1
0
Fork 0
Code Releases Activity

midx: double-check large object write loop 

The write_midx_large_offsets() function takes an array of object
entries, the number of entries in the array (nr_objects), and the number
of entries with large offsets (nr_large_offset). But we never actually
use nr_objects; instead we keep walking down the array and counting down
nr_large_offset until we've seen all of the large entries.

This is correct, but we can be a bit more defensive. If there were ever
a mismatch between nr_large_offset and the actual set of large-offset
objects, we'd walk off the end of the array.

Since we know the size of the array, we can use nr_objects to make sure
we don't walk too far.

Signed-off-by: Jeff King <peff@peff.net>
Reviewed-by: Derrick Stolee <dstolee@microsoft.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
maint
Jeff King 2018-11-03 22:27:46 -04:00 committed by Junio C Hamano
parent 517fe807d6
commit 61b0fcbb64
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
midx.c
View File

@ -712,12 +712,18 @@ static size_t write_midx_object_offsets(struct hashfile *f, int large_offset_nee
static size_t write_midx_large_offsets(struct hashfile *f, uint32_t nr_large_offset, static size_t write_midx_large_offsets(struct hashfile *f, uint32_t nr_large_offset,
struct pack_midx_entry *objects, uint32_t nr_objects) struct pack_midx_entry *objects, uint32_t nr_objects)
{ {
struct pack_midx_entry *list = objects; struct pack_midx_entry *list = objects, *end = objects + nr_objects;
size_t written = 0; size_t written = 0;


while (nr_large_offset) { while (nr_large_offset) {
struct pack_midx_entry *obj = list++; struct pack_midx_entry *obj;
uint64_t offset = obj->offset; uint64_t offset;

if (list >= end)
BUG("too many large-offset objects");

obj = list++;
offset = obj->offset;


if (!(offset >> 31)) if (!(offset >> 31))
continue; continue;