Browse Source

Reject pack if delta exceeds array size limit

JGit's delta handling code requires the target to be a single byte
array. Any attempt to inflate a delta larger than fits in the 2GiB
limit will fail with some form of array index exceptions. Check for
this overflow early and abort pack parsing.

Change-Id: I5bb3a71f1e4f4e0e89b8a177c7019a74ee6194da
stable-4.10
Shawn Pearce 7 years ago
parent
commit
2ec71a7c0e
  1. 2
      org.eclipse.jgit.test/tst/org/eclipse/jgit/transport/PackParserTest.java
  2. 8
      org.eclipse.jgit/src/org/eclipse/jgit/transport/PackParser.java

2
org.eclipse.jgit.test/tst/org/eclipse/jgit/transport/PackParserTest.java

@ -270,7 +270,7 @@ public class PackParserTest extends RepositoryTestCase {
fail("PackParser should have failed");
} catch (TooLargeObjectInPackException e) {
assertTrue(e.getMessage().contains("13")); // max obj size
assertFalse(e.getMessage().contains("14")); // no delta size
assertTrue(e.getMessage().contains("14")); // delta size
}
}

8
org.eclipse.jgit/src/org/eclipse/jgit/transport/PackParser.java

@ -701,7 +701,7 @@ public abstract class PackParser {
private final void checkIfTooLarge(int typeCode, long size)
throws IOException {
if (0 < maxObjectSizeLimit && maxObjectSizeLimit < size)
if (0 < maxObjectSizeLimit && maxObjectSizeLimit < size) {
switch (typeCode) {
case Constants.OBJ_COMMIT:
case Constants.OBJ_TREE:
@ -711,7 +711,7 @@ public abstract class PackParser {
case Constants.OBJ_OFS_DELTA:
case Constants.OBJ_REF_DELTA:
throw new TooLargeObjectInPackException(maxObjectSizeLimit);
throw new TooLargeObjectInPackException(size, maxObjectSizeLimit);
default:
throw new IOException(MessageFormat.format(
@ -719,6 +719,10 @@ public abstract class PackParser {
Integer.valueOf(typeCode)));
}
}
if (size > Integer.MAX_VALUE - 8) {
throw new TooLargeObjectInPackException(size, Integer.MAX_VALUE - 8);
}
}
/**
* Read the header of the current object.

Loading…
Cancel
Save