diff options
| author |  Junio C Hamano <gitster@pobox.com> | 2021-12-10 14:35:08 -0800 |
|---|---|---|
| committer | Junio C Hamano <gitster@pobox.com> | 2021-12-10 14:35:08 -0800 |
| commit | 2d5b70de2d285ed938877c0d9f869ab062037a3b (patch) | |
| tree | e483e82bca1606446972fc970170a9d4fab7bc4e | |
| parent | Merge branch 'jk/jump-merge-with-pathspec' (diff) | |
| parent | packfile: avoid overflowing shift during decode (diff) | |
| download | tgif-2d5b70de2d285ed938877c0d9f869ab062037a3b.tar.xz | |
Merge branch 'jt/pack-header-lshift-overflow'
The code to decode the length of packed object size has been
corrected.
* jt/pack-header-lshift-overflow:
packfile: avoid overflowing shift during decode
| -rw-r--r-- | packfile.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/packfile.c b/packfile.c index 6423d77faa..e30b051c8a 100644 --- a/packfile.c +++ b/packfile.c @@ -1068,7 +1068,7 @@ unsigned long unpack_object_header_buffer(const unsigned char *buf, size = c & 15; shift = 4; while (c & 0x80) { - if (len <= used || bitsizeof(long) <= shift) { + if (len <= used || (bitsizeof(long) - 7) <= shift) { error("bad object header"); size = used = 0; break; |