From ecb5c4318cd8b5bbb72f943b6128fe946ffcb56e Mon Sep 17 00:00:00 2001 From: Patrick Steinhardt Date: Mon, 7 Oct 2024 06:38:21 +0200 Subject: unpack-trees: detect mismatching number of cache-tree/index entries Same as the preceding commit, we unconditionally dereference the index's cache entries depending on the number of cache-tree entries, which can lead to a segfault when the cache-tree is corrupted. Fix this bug. This also makes t4058 pass with the leak sanitizer enabled. Signed-off-by: Patrick Steinhardt Signed-off-by: Junio C Hamano --- unpack-trees.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'unpack-trees.c') diff --git a/unpack-trees.c b/unpack-trees.c index 21cc197d47..e10a9d1209 100644 --- a/unpack-trees.c +++ b/unpack-trees.c @@ -808,6 +808,8 @@ static int traverse_by_cache_tree(int pos, int nr_entries, int nr_names, if (!o->merge) BUG("We need cache-tree to do this optimization"); + if (nr_entries + pos > o->src_index->cache_nr) + return error(_("corrupted cache-tree has entries not present in index")); /* * Do what unpack_callback() and unpack_single_entry() normally -- cgit v1.3