diff mbox series

[05/20] midx.c: prevent overflow in `nth_midxed_object_oid()`

Message ID 1a60b79296c567da33cb8e7001ff21c484836989.1689205042.git.me@ttaylorr.com (mailing list archive)
State Accepted
Commit c2b24ede229dbc6686e37c8cae1e169fc356049e
Headers show
Series guard object lookups against 32-bit overflow | expand

Commit Message

Taylor Blau July 12, 2023, 11:37 p.m. UTC 
In a similar spirit as previous commits, avoid overflow when looking up
an object's OID in a MIDX when its position is greater than
`2^32-1/m->hash_len`.

As usual, it is perfectly OK for a MIDX to have as many as 2^32-1
objects (since we use 32-bit fields to count the number of objects at
each fanout layer). But if we have more than `2^32-1/m->hash_len` number
of objects, we will incorrectly perform the computation using 32-bit
integers, overflowing the result.

Signed-off-by: Taylor Blau <me@ttaylorr.com>
---
 midx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/midx.c b/midx.c
index 449c10289c..dbc63c0d42 100644
--- a/midx.c
+++ b/midx.c
@@ -254,7 +254,7 @@  struct object_id *nth_midxed_object_oid(struct object_id *oid,
 	if (n >= m->num_objects)
 		return NULL;
 
-	oidread(oid, m->chunk_oid_lookup + m->hash_len * n);
+	oidread(oid, m->chunk_oid_lookup + st_mult(m->hash_len, n));
 	return oid;
 }