GitoxideLabs/gitoxide gix-pack-v0.75.0

gix-pack v0.75.0

on GitHub

New Features

• expose the pack header size

  The 12-byte pack header length was repeated in readers, offset validation,
  and tests, leaving the first-entry boundary expressed as a magic number.

  Expose data::header::SIZE, derive it from the fixed header fields, and use
  it wherever code needs the first valid pack-entry offset.

Bug Fixes

• reject delta instructions that exceed the result size

  rubber stamp, looked at diff

  Writing to a byte slice may succeed with a short write. Delta application
  ignored that byte count, so oversized copy and insert instructions silently
  truncated their output instead of reporting corrupt data.

  Split off an output slice of exactly the required size before copying.
  This also removes two mappings of I/O failures that slice writes cannot
  produce. A regression covers both copy and insert instructions; all
  gix-pack tests pass.

• avoid aborts in remaining capacity hints

  A follow-up audit for GHSA-x862-c2wj-4mwr found that the shared exact_vec()
  optimization still used infallible reservation at four other call sites,
  multi-index writing reserved from index counts infallibly, and doubled thin-pack
  size hints could overflow on 32-bit targets.

  Treat exact preallocation as best-effort, propagate multi-index reservation
  failure, and saturate the thin-pack upper bound. Regression tests cover failed
  exact preallocation and size-hint overflow without making large allocations.

• make delta-tree allocation fallible

  GHSA-x862-c2wj-4mwr identified that delta-tree capacity derived from pack
  metadata used an infallible exact reservation. A rejected allocation could
  therefore terminate the process instead of returning through the existing
  indexing error path.

  Use fallible exact reservations, reject capacity arithmetic overflow, and apply
  the existing per-allocation limit to both initial tree vectors. The regression
  covers allocator rejection and explicit zero limits; bundle and index tests
  verify the propagated error.

  Git reference: builtin/index-pack.c reads the advertised object count in
  parse_pack_header() and allocates its object tables with CALLOC_ARRAY. This
  change retains gitoxide's eager sizing while making failure recoverable and
  configurable.

• reject delta bases in the pack header

  OFS_DELTA bases must refer to an earlier pack entry, but the shared offset
  helper accepted offsets within the 12-byte pack header. This let all new
  consumers treat these malformed distances as valid.

  Require the computed base offset to start at or beyond the first entry, matching
  git index-pack, and cover both the shared boundary and pack-copy error path.

• reject invalid delta offsets in pack consumers

  An audit for the same unchecked OFS_DELTA subtraction found two further
  pack-data consumers that trusted raw base distances: delta-tree construction
  during verification and entry reuse during pack generation.

  Use Header::verified_base_pack_offset() in both paths. Verification now
  reports corrupt input through its existing invalid-data error, while pack
  generation declines to copy the malformed entry and uses its existing
  decode/recompress fallback.

  This matches Git at f78ce2f7b6df702f93d40b85d6bda92a3f65da79, where pack
  readers reject delta base offsets outside the pack prefix.

• reject invalid thin-pack delta offsets

  GHSA-mpf5-465h-mr53 identifies a panic while thin-pack base insertion rewrites
  later OFS_DELTA entries. Zero or out-of-bounds base distances reached
  checked_sub().expect() instead of being treated as malformed input.

  Reuse Header::verified_base_pack_offset() and propagate a typed input
  error. This matches Git at f78ce2f7b6df702f93d40b85d6bda92a3f65da79, where
  builtin/index-pack.c rejects delta base offsets outside the pack prefix.

• support version 3 across pack writers

  An audit following GHSA-633h-mqjc-8rwg found four more assertions that rejected
  version 3 in pack-writing paths even though versions 2 and 3 share their entry
  encoding.

  Remove the stale assertions so thin-pack repair and the general pack-generation
  pipeline consistently preserve supported input versions. Extend the bundle
  regression through the thin-pack lookup path that previously still panicked.

  Git baseline: pack_version_ok_native() in pack.h at f78ce2f7b6 accepts
  versions 2 and 3.

• accept version 3 in streaming pack input

  BytesToEntriesIter asserted that every decoded pack used version 2 even though
  the shared header decoder and file reader accept version 3. This made streaming
  input disagree with the rest of the crate and with Git.

  Remove the contradictory assertion and exercise a complete version 3 fixture
  through the streaming iterator. This addresses GHSA-633h-mqjc-8rwg without
  adding another version gate.

  Git baseline: pack_version_ok_native() in pack.h at f78ce2f7b6 accepts
  versions 2 and 3 with the same entry layout.

Changed (BREAKING)

• migrate errors to gix-error

  rubberstamp

• raise MSRV to Rust 1.88

  The newly published dua-core 3.3 release used by linked-worktree removal
  requires Rust 1.88, so raise every workspace crate and the advertised badge
  together.

  Keep the MSRV checks buildable by selecting the latest sysinfo and rusqlite
  release lines that support Rust 1.88.

Commit Statistics

• 22 commits contributed to the release over the course of 31 calendar days.
• 32 days passed between releases.
• 11 commits were understood as conventional.
• 0 issues like '(#ID)' were seen in commit messages

Commit Details