From 0d5a729cde62fc33ad407567e5988711e280aad9 Mon Sep 17 00:00:00 2001 From: Srujith A Poojary Date: Thu, 22 Oct 2026 12:00:32 +0000 Subject: [PATCH] diff-delta: use safe integer arithmetic Replace manual multiplication and addition in create_delta_index() with safe integer helpers (st_mult, st_add, st_add3) to prevent potential overflows when computing memory allocation sizes. For the unpacked index, we allocate hsize instances of hash pointers and entries instances of struct index_entry: - hsize is capped at 2^26. - entries is capped at 2^28. On 32-bit platforms with 4-byte padding for struct unpacked_index_entry, the calculation size (sizeof(*hash) * hsize + sizeof(*entry) * entries) can exceed 2^32, making safe integer arithmetic necessary. Similarly, for the packed index, we compute allocation size across struct index, packed_hash, and entries. Using safe helpers prevents wrap-around across both allocations. Note that passing (hsize + 1) as an argument to st_add3() is safe from overflow because hsize is capped at 2^26 early in the function. Signed-off-by: Srujith A Poojary --- diff-delta.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/diff-delta.c b/diff-delta.c index 7cbedeb5071bcc..efebce3aca49a1 100644 --- a/diff-delta.c +++ b/diff-delta.c @@ -162,8 +162,8 @@ struct delta_index * create_delta_index(const void *buf, size_t bufsize) hmask = hsize - 1; /* allocate lookup index */ - memsize = sizeof(*hash) * hsize + - sizeof(*entry) * entries; + memsize = st_add(st_mult(sizeof(*hash), hsize), + st_mult(sizeof(*entry), entries)); mem = malloc(memsize); if (!mem) return NULL; @@ -258,9 +258,9 @@ struct delta_index * create_delta_index(const void *buf, size_t bufsize) * Now create the packed index in array form * rather than linked lists. */ - memsize = sizeof(*index) - + sizeof(*packed_hash) * (hsize+1) - + sizeof(*packed_entry) * entries; + memsize = st_add3(sizeof(*index), + st_mult(sizeof(*packed_hash), hsize + 1), + st_mult(sizeof(*packed_entry), entries)); mem = malloc(memsize); if (!mem) { free(hash);