GitoxideLabs/gitoxide gix-pack-v0.71.0

gix-pack v0.71.0

on GitHub

New Features

• Add SHA-256 support
  This means that if compiled in, SHA-256 packs can now be read and used.

Other

• reject truncated delta headers within their own data range
  ClusterFuzz reported a panic in gix-pack's data_file fuzz target for testcase
  clusterfuzz-testcase-minimized-gix-pack-data_file-6499869547364352. The
  minimized pack could reach File::decode_entry() and panic while applying a
  relocated delta instruction range with the slice error 'slice index starts at 11
  but ends at 9'.

  The first delta decoding pass stored all decompressed delta instructions
  contiguously, but decoded each delta's base and result size headers from the
  remaining combined instruction buffer. If a malformed delta header continued
  past that delta's declared decompressed size, header parsing could consume
  bytes from the following delta and produce an invalid instruction range for the
  current delta.

  Limit delta size-header parsing to the current delta's decompressed instruction
  range so truncated malformed headers become delta corruption errors instead of
  cross-delta ranges. Add the ClusterFuzz artifact and a regression that exercises
  the same offsets as the data_file fuzz target.

  It's notable that it doesn't reproduce when run in debug mode or with the test-suite,
  but it does reproduce with the fuzzer, and it's fixed now (hence does not reproduce).
  To keep the suite simple, I removed the extra test.

Commit Statistics

• 21 commits contributed to the release over the course of 28 calendar days.
• 28 days passed between releases.
• 2 commits were understood as conventional.
• 0 issues like '(#ID)' were seen in commit messages

Commit Details