Skip to content

Commit 28662c1

Browse files
committed
libFuzzer: Prevent a potential shift overflow
The type of |base_offset| in get_delta_base() is `git_off_t`, which is a signed `long`. That means that we need to make sure that the 8 most significant bits are zero (instead of 7) to avoid an overflow when it is shifted by 7 bits. Found using libFuzzer.
1 parent 429bb35 commit 28662c1

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

src/pack.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -939,7 +939,7 @@ git_off_t get_delta_base(
939939
if (left <= used)
940940
return GIT_EBUFS;
941941
base_offset += 1;
942-
if (!base_offset || MSB(base_offset, 7))
942+
if (!base_offset || MSB(base_offset, 8))
943943
return 0; /* overflow */
944944
c = base_info[used++];
945945
base_offset = (base_offset << 7) + (c & 127);

0 commit comments

Comments
 (0)