commit 66e6097f5d9b6050841626edfd5c094114eeae28 from: Omar Polo via: Thomas Adam date: Thu Oct 27 11:26:40 2022 UTC convert got_pack' filesize to off_t; ok stsp@ commit - 2aef7b234d92623c36d4b113d21ed5ecc010a926 commit + 66e6097f5d9b6050841626edfd5c094114eeae28 blob - fa09c1ca57d4bdb4c0dec036592b4d2967d28018 blob + abe192c382dbe1bb870697cc6a10af15525c2cdf --- gotd/repo_write.c +++ gotd/repo_write.c @@ -1000,15 +1000,10 @@ recv_packfile(struct repo_write_client **client, struc log_debug("pack data received"); - /* XXX size_t vs off_t, both should be off_t */ - if (pack_filesize >= SIZE_MAX) { - err = got_error_msg(GOT_ERR_BAD_PACKFILE, - "pack file too large"); - goto done; - } pack->filesize = pack_filesize; - log_debug("begin indexing pack (%zu bytes in size)", pack->filesize); + log_debug("begin indexing pack (%lld bytes in size)", + (long long)pack->filesize); err = got_pack_index(pack, (*client)->packidx_fd, tempfiles[0], tempfiles[1], tempfiles[2], (*client)->pack_sha1, pack_index_progress, NULL, &rl); blob - 38d0cdc9b37e656d62eca1ed1def96ff6e7e2ef5 blob + 00518379da8d1ea10fa247bbd516547bf00019e1 --- lib/got_lib_pack.h +++ lib/got_lib_pack.h @@ -25,7 +25,7 @@ struct got_pack { char *path_packfile; int fd; uint8_t *map; - size_t filesize; + off_t filesize; struct got_pack_privsep_child *privsep_child; int basefd; int accumfd; blob - 5cf1527ffe0a87f0230d30e38679be072e8923e0 blob + c9234999b21b43c91b7595360c597b1d528f69c1 --- lib/got_lib_privsep.h +++ lib/got_lib_privsep.h @@ -514,7 +514,7 @@ struct got_imsg_packidx { /* Structure for GOT_IMSG_PACK. */ struct got_imsg_pack { char path_packfile[PATH_MAX]; - size_t filesize; + off_t filesize; /* Additionally, a file desciptor is passed via imsg. */ } __attribute__((__packed__)); blob - 37cb6aff26ef4f493097e1aea54d0850d54eccc8 blob + 2a560634ba3ed0a4d9d0ba1e4f88286a3a762951 --- lib/pack.c +++ lib/pack.c @@ -853,6 +853,12 @@ got_pack_parse_object_type_and_size(uint8_t *type, uin return got_error(GOT_ERR_PACK_OFFSET); if (pack->map) { + if (offset > SIZE_MAX) { + return got_error_fmt(GOT_ERR_PACK_OFFSET, + "offset %lld overflows size_t", + (long long)offset); + } + mapoff = (size_t)offset; } else { if (lseek(pack->fd, offset, SEEK_SET) == -1) @@ -932,6 +938,13 @@ parse_negative_offset(int64_t *offset, size_t *len, st if (pack->map) { size_t mapoff; + + if (delta_offset + *len > SIZE_MAX) { + return got_error_fmt(GOT_ERR_PACK_OFFSET, + "mapoff %lld would overflow size_t", + (long long)delta_offset + *len); + } + mapoff = (size_t)delta_offset + *len; if (mapoff + sizeof(offN) >= pack->filesize) return got_error(GOT_ERR_PACK_OFFSET); @@ -1060,7 +1073,7 @@ resolve_offset_delta(struct got_delta_chain *deltas, } err = add_delta(deltas, delta_offset, tslen, delta_type, delta_size, - delta_data_offset); + delta_data_offset); /* XXX: off_t vs size_t! */ if (err) return err; @@ -1082,7 +1095,15 @@ got_pack_parse_ref_delta(struct got_object_id *id, struct got_pack *pack, off_t delta_offset, int tslen) { if (pack->map) { - size_t mapoff = delta_offset + tslen; + size_t mapoff; + + if (delta_offset + tslen > SIZE_MAX) { + return got_error_fmt(GOT_ERR_PACK_OFFSET, + "mapoff %lld would overflow size_t", + (long long)delta_offset + tslen); + } + + mapoff = delta_offset + tslen; if (mapoff + sizeof(*id) >= pack->filesize) return got_error(GOT_ERR_PACK_OFFSET); memcpy(id, pack->map + mapoff, sizeof(*id)); @@ -1127,7 +1148,7 @@ resolve_ref_delta(struct got_delta_chain *deltas, stru } err = add_delta(deltas, delta_offset, tslen, delta_type, delta_size, - delta_data_offset); + delta_data_offset); /* XXX: off_t vs size_t */ if (err) return err; @@ -1394,7 +1415,16 @@ got_pack_dump_delta_chain_to_file(size_t *result_size, max_size = delta->size; if (max_size > max_bufsize) { if (pack->map) { - mapoff = (size_t)delta_data_offset; + if (delta_data_offset > SIZE_MAX) { + return got_error_fmt( + GOT_ERR_RANGE, + "delta offset %lld " + "overflows size_t", + (long long) + delta_data_offset); + } + + mapoff = delta_data_offset; err = got_inflate_to_file_mmap( &base_bufsz, NULL, NULL, pack->map, mapoff, pack->filesize - mapoff, @@ -1411,7 +1441,16 @@ got_pack_dump_delta_chain_to_file(size_t *result_size, } accum_bufsz = max_size; if (pack->map) { - mapoff = (size_t)delta_data_offset; + if (delta_data_offset > SIZE_MAX) { + return got_error_fmt( + GOT_ERR_RANGE, + "delta offset %lld " + "overflows size_t", + (long long) + delta_data_offset); + } + + mapoff = delta_data_offset; err = got_inflate_to_mem_mmap(&base_buf, &base_bufsz, NULL, NULL, pack->map, mapoff, @@ -1567,7 +1606,7 @@ got_pack_dump_delta_chain_to_mem(uint8_t **outbuf, siz uint64_t base_size, result_size = 0; int cached = 1; if (n == 0) { - size_t delta_data_offset; + off_t delta_data_offset; /* Plain object types are the delta base. */ if (delta->type != GOT_OBJ_TYPE_COMMIT && @@ -1588,7 +1627,16 @@ got_pack_dump_delta_chain_to_mem(uint8_t **outbuf, siz max_size = delta->size; if (pack->map) { - size_t mapoff = (size_t)delta_data_offset; + size_t mapoff; + + if (delta_data_offset > SIZE_MAX) { + return got_error_fmt(GOT_ERR_RANGE, + "delta %lld offset would " + "overflow size_t", + (long long)delta_data_offset); + } + + mapoff = delta_data_offset; err = got_inflate_to_mem_mmap(&base_buf, &base_bufsz, NULL, NULL, pack->map, mapoff, pack->filesize - mapoff); @@ -1706,7 +1754,15 @@ got_packfile_extract_object(struct got_pack *pack, str return got_error(GOT_ERR_PACK_OFFSET); if (pack->map) { - size_t mapoff = (size_t)obj->pack_offset; + size_t mapoff; + + if (obj->pack_offset > SIZE_MAX) { + return got_error_fmt(GOT_ERR_RANGE, + "pack offset %lld would overflow size_t", + (long long)obj->pack_offset); + } + + mapoff = obj->pack_offset; err = got_inflate_to_file_mmap(&obj->size, NULL, NULL, pack->map, mapoff, pack->filesize - mapoff, outfile); @@ -1736,7 +1792,15 @@ got_packfile_extract_object_to_mem(uint8_t **buf, size if (obj->pack_offset >= pack->filesize) return got_error(GOT_ERR_PACK_OFFSET); if (pack->map) { - size_t mapoff = (size_t)obj->pack_offset; + size_t mapoff; + + if (obj->pack_offset > SIZE_MAX) { + return got_error_fmt(GOT_ERR_RANGE, + "pack offset %lld would overflow size_t", + (long long)obj->pack_offset); + } + + mapoff = obj->pack_offset; err = got_inflate_to_mem_mmap(buf, len, NULL, NULL, pack->map, mapoff, pack->filesize - mapoff); } else { blob - 0feb1d0818c2aa4643d34ad02023d8423dcb3533 blob + 58ca31024c68f18a97698cdbe0ea6c5702560fba --- lib/pack_index.c +++ lib/pack_index.c @@ -267,6 +267,12 @@ read_packed_object(struct got_pack *pack, struct got_i if (pack->map) { if (mapoff + SHA1_DIGEST_LENGTH >= pack->filesize) { err = got_error(GOT_ERR_BAD_PACKFILE); + break; + } + if (mapoff + SHA1_DIGEST_LENGTH > SIZE_MAX) { + err = got_error_fmt(GOT_ERR_RANGE, + "mapoff %lld would overflow size_t", + (long long)mapoff + SHA1_DIGEST_LENGTH); break; } memcpy(obj->delta.ref.ref_id.sha1, pack->map + mapoff, @@ -318,6 +324,14 @@ read_packed_object(struct got_pack *pack, struct got_i break; } + if (mapoff + obj->delta.ofs.base_offsetlen > + SIZE_MAX) { + err = got_error_fmt(GOT_ERR_RANGE, + "mapoff %lld would overflow size_t", + (long long)mapoff + + obj->delta.ofs.base_offsetlen); + } + obj->crc = crc32(obj->crc, pack->map + mapoff, obj->delta.ofs.base_offsetlen); SHA1Update(pack_sha1_ctx, pack->map + mapoff, @@ -795,6 +809,13 @@ got_pack_index(struct got_pack *pack, int idxfd, FILE /* Verify the SHA1 checksum stored at the end of the pack file. */ if (pack->map) { + if (pack->filesize > SIZE_MAX) { + err = got_error_fmt(GOT_ERR_RANGE, + "filesize %lld overflows size_t", + (long long)pack->filesize); + goto done; + } + memcpy(pack_sha1_expected, pack->map + pack->filesize - SHA1_DIGEST_LENGTH, SHA1_DIGEST_LENGTH); blob - a0f1d4ae390427012f9e7eb33d474c2bfb450b32 blob + a7606b8b2937a303d4d0f298209c1dabd9bb721b --- libexec/got-index-pack/got-index-pack.c +++ libexec/got-index-pack/got-index-pack.c @@ -186,7 +186,7 @@ main(int argc, char **argv) err = got_error_from_errno("lseek"); goto done; } - pack.filesize = packfile_size; /* XXX off_t vs size_t */ + pack.filesize = packfile_size; if (lseek(pack.fd, 0, SEEK_SET) == -1) { err = got_error_from_errno("lseek");