diff options
| author | Marc Strapetz <marc.strapetz@syntevo.com> | 2020-08-12 14:50:20 +0200 |
|---|---|---|
| committer | Thomas Wolf <thomas.wolf@paranor.ch> | 2020-08-25 12:42:53 -0400 |
| commit | 0220f32e5a60d3f0ac4acd3d2f35fd5a2a44809a (patch) | |
| tree | dcc118e35dbf5ae2498ddee218a4dbd0ea0bdcb3 /org.eclipse.jgit | |
| parent | 2990ad66ade8289f1d91a00b65a2406fabd1dea2 (diff) | |
| download | jgit-0220f32e5a60d3f0ac4acd3d2f35fd5a2a44809a.tar.gz jgit-0220f32e5a60d3f0ac4acd3d2f35fd5a2a44809a.zip | |
Fix possible NegativeArraySizeException in PackIndexV1
Due to an integer overflow bug, the current "Index file is too large
for jgit" check did not work properly and subsequently a
NegativeArraySizeException was raised.
Change-Id: I2736efb28987c29e56bc946563b7fa781898a94a
Signed-off-by: Marc Strapetz <marc.strapetz@syntevo.com>
Diffstat (limited to 'org.eclipse.jgit')
| -rw-r--r-- | org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/PackIndexV1.java | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/PackIndexV1.java b/org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/PackIndexV1.java index 9cf95d0720..eb0ac6a062 100644 --- a/org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/PackIndexV1.java +++ b/org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/PackIndexV1.java @@ -49,11 +49,11 @@ class PackIndexV1 extends PackIndex { idxHeader[k] = NB.decodeUInt32(fanoutTable, k * 4); idxdata = new byte[idxHeader.length][]; for (int k = 0; k < idxHeader.length; k++) { - int n; + long n; if (k == 0) { - n = (int) (idxHeader[k]); + n = idxHeader[k]; } else { - n = (int) (idxHeader[k] - idxHeader[k - 1]); + n = idxHeader[k] - idxHeader[k - 1]; } if (n > 0) { final long len = n * (Constants.OBJECT_ID_LENGTH + 4); |