Browse Source

Reject pack if delta exceeds array size limit

JGit's delta handling code requires the target to be a single byte
array. Any attempt to inflate a delta larger than fits in the 2GiB
limit will fail with some form of array index exceptions. Check for
this overflow early and abort pack parsing.

Change-Id: I5bb3a71f1e4f4e0e89b8a177c7019a74ee6194da
stable-4.10
Shawn Pearce 7 years ago
parent
commit
2ec71a7c0e
  1. 2
      org.eclipse.jgit.test/tst/org/eclipse/jgit/transport/PackParserTest.java
  2. 8
      org.eclipse.jgit/src/org/eclipse/jgit/transport/PackParser.java

2
org.eclipse.jgit.test/tst/org/eclipse/jgit/transport/PackParserTest.java

@ -270,7 +270,7 @@ public class PackParserTest extends RepositoryTestCase {
fail("PackParser should have failed"); fail("PackParser should have failed");
} catch (TooLargeObjectInPackException e) { } catch (TooLargeObjectInPackException e) {
assertTrue(e.getMessage().contains("13")); // max obj size assertTrue(e.getMessage().contains("13")); // max obj size
assertFalse(e.getMessage().contains("14")); // no delta size assertTrue(e.getMessage().contains("14")); // delta size
} }
} }

8
org.eclipse.jgit/src/org/eclipse/jgit/transport/PackParser.java

@ -701,7 +701,7 @@ public abstract class PackParser {
private final void checkIfTooLarge(int typeCode, long size) private final void checkIfTooLarge(int typeCode, long size)
throws IOException { throws IOException {
if (0 < maxObjectSizeLimit && maxObjectSizeLimit < size) if (0 < maxObjectSizeLimit && maxObjectSizeLimit < size) {
switch (typeCode) { switch (typeCode) {
case Constants.OBJ_COMMIT: case Constants.OBJ_COMMIT:
case Constants.OBJ_TREE: case Constants.OBJ_TREE:
@ -711,7 +711,7 @@ public abstract class PackParser {
case Constants.OBJ_OFS_DELTA: case Constants.OBJ_OFS_DELTA:
case Constants.OBJ_REF_DELTA: case Constants.OBJ_REF_DELTA:
throw new TooLargeObjectInPackException(maxObjectSizeLimit); throw new TooLargeObjectInPackException(size, maxObjectSizeLimit);
default: default:
throw new IOException(MessageFormat.format( throw new IOException(MessageFormat.format(
@ -719,6 +719,10 @@ public abstract class PackParser {
Integer.valueOf(typeCode))); Integer.valueOf(typeCode)));
} }
} }
if (size > Integer.MAX_VALUE - 8) {
throw new TooLargeObjectInPackException(size, Integer.MAX_VALUE - 8);
}
}
/** /**
* Read the header of the current object. * Read the header of the current object.

Loading…
Cancel
Save