Repository navigation
Conversation
An object record's count of offsets is a 64-bit varint from the table, and reftable_obj_record_decode allocated the offsets array from it through REFTABLE_ALLOC_ARRAY, which takes a size_t. Where size_t is 32 bits, a count of 2^32 + 1 allocates room for one offset, and the loop, which runs to the full count, writes an offset from the table for each varint left in the block past the end of the array. Where size_t is 64 bits, a large count only makes a large allocation that the decode then fails to fill, so this is a real problem only on 32-bit builds. Nothing in libgit2 reaches this decoder: a block of a type other than the one wanted is refused before its records are decoded, and the object index, the only reader of object blocks, is not used. The decoder is still wrong. Each offset takes at least a byte, so refuse a count larger than what is left of the record.
Member
|
We take the reftable dependency directly from git. I'd ask you to take this update to them first and then we'll include it. 🙏 |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
An object record's count of offsets is a 64-bit varint from the table,
and reftable_obj_record_decode allocated the offsets array from it
through REFTABLE_ALLOC_ARRAY, which takes a size_t. Where size_t is 32
bits, a count of 2^32 + 1 allocates room for one offset, and the loop,
which runs to the full count, writes an offset from the table for each
varint left in the block past the end of the array. Where size_t is 64
bits, a large count only makes a large allocation that the decode then
fails to fill, so this is a real problem only on 32-bit builds.
Nothing in libgit2 reaches this decoder: a block of a type other than
the one wanted is refused before its records are decoded, and the
object index, the only reader of object blocks, is not used. The
decoder is still wrong.
Each offset takes at least a byte, so refuse a count larger than what
is left of the record.