op public repos

Blob

Date:: Fri Oct 15 17:17:52 2021 UTC
Message:: plug memory leak in an error path of read_packed_object()
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2019 Ori Bernstein <ori@openbsd.org>
3  * Copyright (c) 2020 Stefan Sperling <stsp@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <sys/queue.h>
19 #include <sys/stat.h>
20 #include <sys/time.h>
21 #include <sys/types.h>
22 #include <sys/uio.h>
23 #include <sys/mman.h>
24 
25 #include <stdint.h>
26 #include <errno.h>
27 #include <imsg.h>
28 #include <limits.h>
29 #include <signal.h>
30 #include <stdio.h>
31 #include <stdlib.h>
32 #include <string.h>
33 #include <ctype.h>
34 #include <sha1.h>
35 #include <endian.h>
36 #include <fcntl.h>
37 #include <unistd.h>
38 #include <zlib.h>
39 #include <err.h>
40 #include <assert.h>
41 #include <dirent.h>
42 
43 #include "got_error.h"
44 #include "got_object.h"
45 
46 #include "got_lib_sha1.h"
47 #include "got_lib_delta.h"
48 #include "got_lib_inflate.h"
49 #include "got_lib_object.h"
50 #include "got_lib_object_parse.h"
51 #include "got_lib_object_idset.h"
52 #include "got_lib_privsep.h"
53 #include "got_lib_pack.h"
54 #include "got_lib_delta_cache.h"
55 
56 #ifndef nitems
57 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
58 #endif
59 
60 struct got_indexed_object {
61 	struct got_object_id id;
62 
63 	/*
64 	 * Has this object been fully resolved?
65 	 * If so, we know its ID, otherwise we don't and 'id' is invalid.
66 	 */
67 	int valid;
68 
69 	/* Offset of type+size field for this object in pack file. */
70 	off_t off;
71 
72 	/* Type+size values parsed from pack file. */
73 	uint8_t type;
74 	uint64_t size;
75 
76 	/* Length of on-disk type+size data. */
77 	size_t tslen; 
78 
79 	/* Length of object data following type+size. */
80 	size_t len; 
81 
82 	uint32_t crc;
83 
84 	union {
85 		struct {
86 			/* For ref deltas. */
87 			struct got_object_id ref_id;
88 		} ref;
89 		struct {
90 			/* For offset deltas. */
91 			off_t base_offset;
92 			size_t base_offsetlen;
93 		} ofs;
94 	} delta;
95 };
96 
97 static void
98 putbe32(char *b, uint32_t n)
99 {
100 	b[0] = n >> 24;
101 	b[1] = n >> 16;
102 	b[2] = n >> 8;
103 	b[3] = n >> 0;
104 }
105 
106 static const struct got_error *
107 get_obj_type_label(const char **label, int obj_type)
108 {
109 	const struct got_error *err = NULL;
110 
111 	switch (obj_type) {
112 	case GOT_OBJ_TYPE_BLOB:
113 		*label = GOT_OBJ_LABEL_BLOB;
114 		break;
115 	case GOT_OBJ_TYPE_TREE:
116 		*label = GOT_OBJ_LABEL_TREE;
117 		break;
118 	case GOT_OBJ_TYPE_COMMIT:
119 		*label = GOT_OBJ_LABEL_COMMIT;
120 		break;
121 	case GOT_OBJ_TYPE_TAG:
122 		*label = GOT_OBJ_LABEL_TAG;
123 		break;
124 	default:
125 		*label = NULL;
126 		err = got_error(GOT_ERR_OBJ_TYPE);
127 		break;
128 	}
129 
130 	return err;
131 }
132 
133 static const struct got_error *
134 read_checksum(uint32_t *crc, SHA1_CTX *sha1_ctx, int fd, size_t len)
135 {
136 	uint8_t buf[8192];
137 	size_t n;
138 	ssize_t r;
139 
140 	for (n = len; n > 0; n -= r){
141 		r = read(fd, buf, n > sizeof(buf) ? sizeof(buf) : n);
142 		if (r == -1)
143 			return got_error_from_errno("read");
144 		if (r == 0)
145 			break;
146 		if (crc)
147 			*crc = crc32(*crc, buf, r);
148 		if (sha1_ctx)
149 			SHA1Update(sha1_ctx, buf, r);
150 	}
151 
152 	return NULL;
153 }
154 
155 static const struct got_error *
156 read_file_sha1(SHA1_CTX *ctx, FILE *f, size_t len)
157 {
158 	uint8_t buf[8192];
159 	size_t n, r;
160 
161 	for (n = len; n > 0; n -= r) {
162 		r = fread(buf, 1, n > sizeof(buf) ? sizeof(buf) : n, f);
163 		if (r == 0) {
164 			if (feof(f))
165 				return NULL;
166 			return got_ferror(f, GOT_ERR_IO);
167 		}
168 		SHA1Update(ctx, buf, r);
169 	}
170 
171 	return NULL;
172 }
173 
174 static const struct got_error *
175 read_packed_object(struct got_pack *pack, struct got_indexed_object *obj,
176     FILE *tmpfile, SHA1_CTX *pack_sha1_ctx)
177 {
178 	const struct got_error *err = NULL;
179 	SHA1_CTX ctx;
180 	uint8_t *data = NULL;
181 	size_t datalen = 0;
182 	ssize_t n;
183 	char *header;
184 	size_t headerlen;
185 	const char *obj_label;
186 	size_t mapoff = obj->off;
187 	struct got_inflate_checksum csum;
188 
189 	memset(&csum, 0, sizeof(csum));
190 	csum.input_sha1 = pack_sha1_ctx;
191 	csum.input_crc = &obj->crc;
192 
193 	err = got_pack_parse_object_type_and_size(&obj->type, &obj->size,
194 	    &obj->tslen, pack, obj->off);
195 	if (err)
196 		return err;
197 
198 	if (pack->map) {
199 		obj->crc = crc32(obj->crc, pack->map + mapoff, obj->tslen);
200 		SHA1Update(pack_sha1_ctx, pack->map + mapoff, obj->tslen);
201 		mapoff += obj->tslen;
202 	} else {
203 		/* XXX Seek back and get the CRC of on-disk type+size bytes. */
204 		if (lseek(pack->fd, obj->off, SEEK_SET) == -1)
205 			return got_error_from_errno("lseek");
206 		err = read_checksum(&obj->crc, pack_sha1_ctx,
207 		    pack->fd, obj->tslen);
208 		if (err)
209 			return err;
210 	}
211 
212 	switch (obj->type) {
213 	case GOT_OBJ_TYPE_BLOB:
214 	case GOT_OBJ_TYPE_COMMIT:
215 	case GOT_OBJ_TYPE_TREE:
216 	case GOT_OBJ_TYPE_TAG:
217 		if (obj->size > GOT_DELTA_RESULT_SIZE_CACHED_MAX) {
218 			if (fseek(tmpfile, 0L, SEEK_SET) == -1) {
219 				err = got_error_from_errno("fseek");
220 				break;
221 			}
222 			if (pack->map) {
223 				err = got_inflate_to_file_mmap(&datalen,
224 				    &obj->len, &csum, pack->map, mapoff,
225 				    pack->filesize - mapoff, tmpfile);
226 			} else {
227 				err = got_inflate_to_file_fd(&datalen,
228 				    &obj->len, &csum, pack->fd, tmpfile);
229 			}
230 		} else {
231 			if (pack->map) {
232 				err = got_inflate_to_mem_mmap(&data, &datalen,
233 				    &obj->len, &csum, pack->map, mapoff,
234 				    pack->filesize - mapoff);
235 			} else {
236 				err = got_inflate_to_mem_fd(&data, &datalen,
237 				    &obj->len, &csum, obj->size, pack->fd);
238 			}
239 		}
240 		if (err)
241 			break;
242 		SHA1Init(&ctx);
243 		err = get_obj_type_label(&obj_label, obj->type);
244 		if (err) {
245 			free(data);
246 			break;
247 		}
248 		if (asprintf(&header, "%s %lld", obj_label,
249 		    (long long)obj->size) == -1) {
250 			err = got_error_from_errno("asprintf");
251 			free(data);
252 			break;
253 		}
254 		headerlen = strlen(header) + 1;
255 		SHA1Update(&ctx, header, headerlen);
256 		if (obj->size > GOT_DELTA_RESULT_SIZE_CACHED_MAX) {
257 			err = read_file_sha1(&ctx, tmpfile, datalen);
258 			if (err) {
259 				free(header);
260 				free(data);
261 				break;
262 			}
263 		} else
264 			SHA1Update(&ctx, data, datalen);
265 		SHA1Final(obj->id.sha1, &ctx);
266 		free(header);
267 		free(data);
268 		break;
269 	case GOT_OBJ_TYPE_REF_DELTA:
270 		memset(obj->id.sha1, 0xff, SHA1_DIGEST_LENGTH);
271 		if (pack->map) {
272 			if (mapoff + SHA1_DIGEST_LENGTH >= pack->filesize) {
273 				err = got_error(GOT_ERR_BAD_PACKFILE);
274 				break;
275 			}
276 			memcpy(obj->delta.ref.ref_id.sha1, pack->map + mapoff,
277 			    SHA1_DIGEST_LENGTH);
278 			obj->crc = crc32(obj->crc, pack->map + mapoff,
279 			    SHA1_DIGEST_LENGTH);
280 			SHA1Update(pack_sha1_ctx, pack->map + mapoff,
281 			    SHA1_DIGEST_LENGTH);
282 			mapoff += SHA1_DIGEST_LENGTH;
283 			err = got_inflate_to_mem_mmap(NULL, &datalen,
284 			    &obj->len, &csum, pack->map, mapoff,
285 			    pack->filesize - mapoff);
286 			if (err)
287 				break;
288 		} else {
289 			n = read(pack->fd, obj->delta.ref.ref_id.sha1,
290 			    SHA1_DIGEST_LENGTH);
291 			if (n == -1) {
292 				err = got_error_from_errno("read");
293 				break;
294 			}
295 			if (n < sizeof(obj->id)) {
296 				err = got_error(GOT_ERR_BAD_PACKFILE);
297 				break;
298 			}
299 			obj->crc = crc32(obj->crc, obj->delta.ref.ref_id.sha1,
300 			    SHA1_DIGEST_LENGTH);
301 			SHA1Update(pack_sha1_ctx, obj->delta.ref.ref_id.sha1,
302 			    SHA1_DIGEST_LENGTH);
303 			err = got_inflate_to_mem_fd(NULL, &datalen, &obj->len,
304 			    &csum, obj->size, pack->fd);
305 			if (err)
306 				break;
307 		}
308 		obj->len += SHA1_DIGEST_LENGTH;
309 		break;
310 	case GOT_OBJ_TYPE_OFFSET_DELTA:
311 		memset(obj->id.sha1, 0xff, SHA1_DIGEST_LENGTH);
312 		err = got_pack_parse_offset_delta(&obj->delta.ofs.base_offset,
313 		    &obj->delta.ofs.base_offsetlen, pack, obj->off,
314 		    obj->tslen);
315 		if (err)
316 			break;
317 
318 		if (pack->map) {
319 			obj->crc = crc32(obj->crc, pack->map + mapoff,
320 			    obj->delta.ofs.base_offsetlen);
321 			SHA1Update(pack_sha1_ctx, pack->map + mapoff,
322 			    obj->delta.ofs.base_offsetlen);
323 			mapoff += obj->delta.ofs.base_offsetlen;
324 			err = got_inflate_to_mem_mmap(NULL, &datalen,
325 			    &obj->len, &csum, pack->map, mapoff,
326 			    pack->filesize - mapoff);
327 			if (err)
328 				break;
329 		} else {
330 			/*
331 			 * XXX Seek back and get CRC and SHA1 of on-disk
332 			 * offset bytes.
333 			 */
334 			if (lseek(pack->fd, obj->off + obj->tslen, SEEK_SET)
335 			    == -1) {
336 				err = got_error_from_errno("lseek");
337 				break;
338 			}
339 			err = read_checksum(&obj->crc, pack_sha1_ctx,
340 			    pack->fd, obj->delta.ofs.base_offsetlen);
341 			if (err)
342 				break;
343 
344 			err = got_inflate_to_mem_fd(NULL, &datalen, &obj->len,
345 			    &csum, obj->size, pack->fd);
346 			if (err)
347 				break;
348 		}
349 		obj->len += obj->delta.ofs.base_offsetlen;
350 		break;
351 	default:
352 		err = got_error(GOT_ERR_OBJ_TYPE);
353 		break;
354 	}
355 
356 	return err;
357 }
358 
359 static const struct got_error *
360 hwrite(int fd, void *buf, int len, SHA1_CTX *ctx)
361 {
362 	ssize_t w;
363 
364 	SHA1Update(ctx, buf, len);
365 
366 	w = write(fd, buf, len);
367 	if (w == -1)
368 		return got_error_from_errno("write");
369 	if (w != len)
370 		return got_error(GOT_ERR_IO);
371 
372 	return NULL;
373 }
374 
375 static const struct got_error *
376 resolve_deltified_object(struct got_pack *pack, struct got_packidx *packidx,
377     struct got_indexed_object *obj, FILE *tmpfile, FILE *delta_base_file,
378     FILE *delta_accum_file)
379 {
380 	const struct got_error *err = NULL;
381 	struct got_delta_chain deltas;
382 	struct got_delta *delta;
383 	uint8_t *buf = NULL;
384 	size_t len = 0;
385 	SHA1_CTX ctx;
386 	char *header = NULL;
387 	size_t headerlen;
388 	uint64_t max_size;
389 	int base_obj_type;
390 	const char *obj_label;
391 
392 	deltas.nentries = 0;
393 	STAILQ_INIT(&deltas.entries);
394 
395 	err = got_pack_resolve_delta_chain(&deltas, packidx, pack,
396 	    obj->off, obj->tslen, obj->type, obj->size,
397 	    GOT_DELTA_CHAIN_RECURSION_MAX);
398 	if (err)
399 		goto done;
400 
401 	err = got_pack_get_delta_chain_max_size(&max_size, &deltas, pack);
402 	if (err)
403 		goto done;
404 	if (max_size > GOT_DELTA_RESULT_SIZE_CACHED_MAX) {
405 		rewind(tmpfile);
406 		rewind(delta_base_file);
407 		rewind(delta_accum_file);
408 		err = got_pack_dump_delta_chain_to_file(&len, &deltas,
409 		    pack, tmpfile, delta_base_file, delta_accum_file);
410 		if (err)
411 			goto done;
412 	} else {
413 		err = got_pack_dump_delta_chain_to_mem(&buf, &len,
414 		    &deltas, pack);
415 	}
416 	if (err)
417 		goto done;
418 
419 	err = got_delta_chain_get_base_type(&base_obj_type, &deltas);
420 	if (err)
421 		goto done;
422 	err = get_obj_type_label(&obj_label, base_obj_type);
423 	if (err)
424 		goto done;
425 	if (asprintf(&header, "%s %zd", obj_label, len) == -1) {
426 		err = got_error_from_errno("asprintf");
427 		goto done;
428 	}
429 	headerlen = strlen(header) + 1;
430 	SHA1Init(&ctx);
431 	SHA1Update(&ctx, header, headerlen);
432 	if (max_size > GOT_DELTA_RESULT_SIZE_CACHED_MAX) {
433 		err = read_file_sha1(&ctx, tmpfile, len);
434 		if (err)
435 			goto done;
436 	} else
437 		SHA1Update(&ctx, buf, len);
438 	SHA1Final(obj->id.sha1, &ctx);
439 done:
440 	free(buf);
441 	free(header);
442 	while (!STAILQ_EMPTY(&deltas.entries)) {
443 		delta = STAILQ_FIRST(&deltas.entries);
444 		STAILQ_REMOVE_HEAD(&deltas.entries, entry);
445 		free(delta);
446 	}
447 	return err;
448 }
449 
450 /* Determine the slot in the pack index a given object ID should use. */
451 static int
452 find_object_idx(struct got_packidx *packidx, uint8_t *sha1)
453 {
454 	u_int8_t id0 = sha1[0];
455 	uint32_t nindexed = be32toh(packidx->hdr.fanout_table[0xff]);
456 	int left = 0, right = nindexed - 1;
457 	int cmp = 0, i = 0;
458 
459 	if (id0 > 0)
460 		left = be32toh(packidx->hdr.fanout_table[id0 - 1]);
461 
462 	while (left <= right) {
463 		struct got_packidx_object_id *oid;
464 
465 		i = ((left + right) / 2);
466 		oid = &packidx->hdr.sorted_ids[i];
467 
468 		cmp = memcmp(sha1, oid->sha1, SHA1_DIGEST_LENGTH);
469 		if (cmp == 0)
470 			return -1; /* object already indexed */
471 		else if (cmp > 0)
472 			left = i + 1;
473 		else if (cmp < 0)
474 			right = i - 1;
475 	}
476 
477 	return left;
478 }
479 
480 #if 0
481 static void
482 print_packidx(struct got_packidx *packidx)
483 {
484 	uint32_t nindexed = be32toh(packidx->hdr.fanout_table[0xff]);
485 	int i;
486 
487 	fprintf(stderr, "object IDs:\n");
488 	for (i = 0; i < nindexed; i++) {
489 		char hex[SHA1_DIGEST_STRING_LENGTH];
490 		got_sha1_digest_to_str(packidx->hdr.sorted_ids[i].sha1,
491 		    hex, sizeof(hex));
492 		fprintf(stderr, "%s\n", hex);
493 	}
494 	fprintf(stderr, "\n");
495 
496 	fprintf(stderr, "object offsets:\n");
497 	for (i = 0; i < nindexed; i++) {
498 		uint32_t offset = be32toh(packidx->hdr.offsets[i]);
499 		if (offset & GOT_PACKIDX_OFFSET_VAL_IS_LARGE_IDX) {
500 			int j = offset & GOT_PACKIDX_OFFSET_VAL_MASK;
501 			fprintf(stderr, "%u -> %llu\n", offset, 
502 			    be64toh(packidx->hdr.large_offsets[j]));
503 		} else
504 			fprintf(stderr, "%u\n", offset);
505 	}
506 	fprintf(stderr, "\n");
507 
508 	fprintf(stderr, "fanout table:");
509 	for (i = 0; i <= 0xff; i++)
510 		fprintf(stderr, " %u", be32toh(packidx->hdr.fanout_table[i]));
511 	fprintf(stderr, "\n");
512 }
513 #endif
514 
515 static void
516 add_indexed_object(struct got_packidx *packidx, uint32_t idx,
517     struct got_indexed_object *obj)
518 {
519 	int i;
520 
521 	memcpy(packidx->hdr.sorted_ids[idx].sha1, obj->id.sha1,
522 	    SHA1_DIGEST_LENGTH);
523 	packidx->hdr.crc32[idx] = htobe32(obj->crc);
524 	if (obj->off < GOT_PACKIDX_OFFSET_VAL_IS_LARGE_IDX)
525 		packidx->hdr.offsets[idx] = htobe32(obj->off);
526 	else {
527 		packidx->hdr.offsets[idx] = htobe32(packidx->nlargeobj |
528 		    GOT_PACKIDX_OFFSET_VAL_IS_LARGE_IDX);
529 		packidx->hdr.large_offsets[packidx->nlargeobj] =
530 		    htobe64(obj->off);
531 		packidx->nlargeobj++;
532 	}
533 
534 	for (i = obj->id.sha1[0]; i <= 0xff; i++) {
535 		uint32_t n = be32toh(packidx->hdr.fanout_table[i]);
536 		packidx->hdr.fanout_table[i] = htobe32(n + 1);
537 	}
538 }
539 
540 static int
541 indexed_obj_cmp(const void *pa, const void *pb)
542 {
543 	struct got_indexed_object *a, *b;
544 
545 	a = (struct got_indexed_object *)pa;
546 	b = (struct got_indexed_object *)pb;
547 	return got_object_id_cmp(&a->id, &b->id);
548 }
549 
550 static void
551 make_packidx(struct got_packidx *packidx, int nobj,
552     struct got_indexed_object *objects)
553 {
554 	struct got_indexed_object *obj;
555 	int i;
556 	uint32_t idx = 0;
557 
558 	qsort(objects, nobj, sizeof(struct got_indexed_object),
559 	    indexed_obj_cmp);
560 
561 	memset(packidx->hdr.fanout_table, 0,
562 	    GOT_PACKIDX_V2_FANOUT_TABLE_ITEMS * sizeof(uint32_t));
563 	packidx->nlargeobj = 0;
564 
565 	for (i = 0; i < nobj; i++) {
566 		obj = &objects[i];
567 		if (obj->valid)
568 			add_indexed_object(packidx, idx++, obj);
569 	}
570 }
571 
572 static void
573 update_packidx(struct got_packidx *packidx, int nobj,
574     struct got_indexed_object *obj)
575 {
576 	int idx;
577 	uint32_t nindexed = be32toh(packidx->hdr.fanout_table[0xff]);
578 
579 	idx = find_object_idx(packidx, obj->id.sha1);
580 	if (idx == -1) {
581 		char hex[SHA1_DIGEST_STRING_LENGTH];
582 		got_sha1_digest_to_str(obj->id.sha1, hex, sizeof(hex));
583 		return; /* object already indexed */
584 	}
585 
586 	memmove(&packidx->hdr.sorted_ids[idx + 1],
587 	    &packidx->hdr.sorted_ids[idx],
588 	    sizeof(struct got_packidx_object_id) * (nindexed - idx));
589 	memmove(&packidx->hdr.offsets[idx + 1], &packidx->hdr.offsets[idx],
590 	    sizeof(uint32_t) * (nindexed - idx));
591 
592 	add_indexed_object(packidx, idx, obj);
593 }
594 
595 static const struct got_error *
596 send_index_pack_progress(struct imsgbuf *ibuf, int nobj_total,
597     int nobj_indexed, int nobj_loose, int nobj_resolved)
598 {
599 	struct got_imsg_index_pack_progress iprogress;
600 
601 	iprogress.nobj_total = nobj_total;
602 	iprogress.nobj_indexed = nobj_indexed;
603 	iprogress.nobj_loose = nobj_loose;
604 	iprogress.nobj_resolved = nobj_resolved;
605 
606 	if (imsg_compose(ibuf, GOT_IMSG_IDXPACK_PROGRESS, 0, 0, -1,
607 	    &iprogress, sizeof(iprogress)) == -1)
608 		return got_error_from_errno("imsg_compose IDXPACK_PROGRESS");
609 
610 	return got_privsep_flush_imsg(ibuf);
611 }
612 
613 static const struct got_error *
614 send_index_pack_done(struct imsgbuf *ibuf)
615 {
616 	if (imsg_compose(ibuf, GOT_IMSG_IDXPACK_DONE, 0, 0, -1, NULL, 0) == -1)
617 		return got_error_from_errno("imsg_compose FETCH");
618 	return got_privsep_flush_imsg(ibuf);
619 }
620 
621 
622 static const struct got_error *
623 index_pack(struct got_pack *pack, int idxfd, FILE *tmpfile,
624     FILE *delta_base_file, FILE *delta_accum_file, uint8_t *pack_sha1_expected,
625     struct imsgbuf *ibuf)
626 {
627 	const struct got_error *err;
628 	struct got_packfile_hdr hdr;
629 	struct got_packidx packidx;
630 	char buf[8];
631 	char pack_sha1[SHA1_DIGEST_LENGTH];
632 	int nobj, nvalid, nloose, nresolved = 0, i;
633 	struct got_indexed_object *objects = NULL, *obj;
634 	SHA1_CTX ctx;
635 	uint8_t packidx_hash[SHA1_DIGEST_LENGTH];
636 	ssize_t r, w;
637 	int pass, have_ref_deltas = 0, first_delta_idx = -1;
638 	size_t mapoff = 0;
639 	int p_indexed = 0, last_p_indexed = -1;
640 	int p_resolved = 0, last_p_resolved = -1;
641 
642 	/* Require that pack file header and SHA1 trailer are present. */
643 	if (pack->filesize < sizeof(hdr) + SHA1_DIGEST_LENGTH)
644 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
645 		    "short pack file");
646 
647 	if (pack->map) {
648 		memcpy(&hdr, pack->map, sizeof(hdr));
649 		mapoff += sizeof(hdr);
650 	} else {
651 		r = read(pack->fd, &hdr, sizeof(hdr));
652 		if (r == -1)
653 			return got_error_from_errno("read");
654 		if (r < sizeof(hdr))
655 			return got_error_msg(GOT_ERR_BAD_PACKFILE,
656 			    "short pack file");
657 	}
658 
659 	if (hdr.signature != htobe32(GOT_PACKFILE_SIGNATURE))
660 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
661 		    "bad packfile signature");
662 	if (hdr.version != htobe32(GOT_PACKFILE_VERSION))
663 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
664 		    "bad packfile version");
665 	nobj = be32toh(hdr.nobjects);
666 	if (nobj == 0)
667 		return got_error_msg(GOT_ERR_BAD_PACKFILE,
668 		    "bad packfile with zero objects");
669 
670 	/* We compute the SHA1 of pack file contents and verify later on. */
671 	SHA1Init(&ctx);
672 	SHA1Update(&ctx, (void *)&hdr, sizeof(hdr));
673 
674 	/*
675 	 * Create an in-memory pack index which will grow as objects
676 	 * IDs in the pack file are discovered. Only fields used to
677 	 * read deltified objects will be needed by the pack.c library
678 	 * code, so setting up just a pack index header is sufficient.
679 	 */
680 	memset(&packidx, 0, sizeof(packidx));
681 	packidx.hdr.magic = malloc(sizeof(uint32_t));
682 	if (packidx.hdr.magic == NULL)
683 		return got_error_from_errno("malloc");
684 	*packidx.hdr.magic = htobe32(GOT_PACKIDX_V2_MAGIC);
685 	packidx.hdr.version = malloc(sizeof(uint32_t));
686 	if (packidx.hdr.version == NULL) {
687 		err = got_error_from_errno("malloc");
688 		goto done;
689 	}
690 	*packidx.hdr.version = htobe32(GOT_PACKIDX_VERSION);
691 	packidx.hdr.fanout_table = calloc(GOT_PACKIDX_V2_FANOUT_TABLE_ITEMS,
692 	    sizeof(uint32_t));
693 	if (packidx.hdr.fanout_table == NULL) {
694 		err = got_error_from_errno("calloc");
695 		goto done;
696 	}
697 	packidx.hdr.sorted_ids = calloc(nobj,
698 	    sizeof(struct got_packidx_object_id));
699 	if (packidx.hdr.sorted_ids == NULL) {
700 		err = got_error_from_errno("calloc");
701 		goto done;
702 	}
703 	packidx.hdr.crc32 = calloc(nobj, sizeof(uint32_t));
704 	if (packidx.hdr.crc32 == NULL) {
705 		err = got_error_from_errno("calloc");
706 		goto done;
707 	}
708 	packidx.hdr.offsets = calloc(nobj, sizeof(uint32_t));
709 	if (packidx.hdr.offsets == NULL) {
710 		err = got_error_from_errno("calloc");
711 		goto done;
712 	}
713 	/* Large offsets table is empty for pack files < 2 GB. */
714 	if (pack->filesize >= GOT_PACKIDX_OFFSET_VAL_IS_LARGE_IDX) {
715 		packidx.hdr.large_offsets = calloc(nobj, sizeof(uint64_t));
716 		if (packidx.hdr.large_offsets == NULL) {
717 			err = got_error_from_errno("calloc");
718 			goto done;
719 		}
720 	}
721 
722 	nvalid = 0;
723 	nloose = 0;
724 	objects = calloc(nobj, sizeof(struct got_indexed_object));
725 	if (objects == NULL)
726 		return got_error_from_errno("calloc");
727 
728 	/*
729 	 * First pass: locate all objects and identify un-deltified objects.
730 	 *
731 	 * When this pass has completed we will know offset, type, size, and
732 	 * CRC information for all objects in this pack file. We won't know
733 	 * any of the actual object IDs of deltified objects yet since we
734 	 * will not yet attempt to combine deltas.
735 	 */
736 	pass = 1;
737 	for (i = 0; i < nobj; i++) {
738 		/* Don't send too many progress privsep messages. */
739 		p_indexed = ((i + 1) * 100) / nobj;
740 		if (p_indexed != last_p_indexed) {
741 			err = send_index_pack_progress(ibuf, nobj, i + 1,
742 			    nloose, 0);
743 			if (err)
744 				goto done;
745 			last_p_indexed = p_indexed;
746 		}
747 
748 		obj = &objects[i];
749 		obj->crc = crc32(0L, NULL, 0);
750 
751 		/* Store offset to type+size information for this object. */
752 		if (pack->map) {
753 			obj->off = mapoff;
754 		} else {
755 			obj->off = lseek(pack->fd, 0, SEEK_CUR);
756 			if (obj->off == -1) {
757 				err = got_error_from_errno("lseek");
758 				goto done;
759 			}
760 		}
761 
762 		err = read_packed_object(pack, obj, tmpfile, &ctx);
763 		if (err)
764 			goto done;
765 
766 		if (pack->map) {
767 			mapoff += obj->tslen + obj->len;
768 		} else {
769 			if (lseek(pack->fd, obj->off + obj->tslen + obj->len,
770 			    SEEK_SET) == -1) {
771 				err = got_error_from_errno("lseek");
772 				goto done;
773 			}
774 		}
775 
776 		if (obj->type == GOT_OBJ_TYPE_BLOB ||
777 		    obj->type == GOT_OBJ_TYPE_TREE ||
778 		    obj->type == GOT_OBJ_TYPE_COMMIT ||
779 		    obj->type == GOT_OBJ_TYPE_TAG) {
780 			obj->valid = 1;
781 			nloose++;
782 		} else {
783 			if (first_delta_idx == -1)
784 				first_delta_idx = i;
785 			if (obj->type == GOT_OBJ_TYPE_REF_DELTA)
786 				have_ref_deltas = 1;
787 		}
788 	}
789 	nvalid = nloose;
790 
791 	/*
792 	 * Having done a full pass over the pack file and can now
793 	 * verify its checksum.
794 	 */
795 	SHA1Final(pack_sha1, &ctx);
796 	if (memcmp(pack_sha1_expected, pack_sha1, SHA1_DIGEST_LENGTH) != 0) {
797 		err = got_error_msg(GOT_ERR_BAD_PACKFILE,
798 		    "pack file checksum mismatch");
799 		goto done;
800 	}
801 
802 	/* Verify the SHA1 checksum stored at the end of the pack file. */
803 	if (pack->map) {
804 		memcpy(pack_sha1_expected, pack->map +
805 		    pack->filesize - SHA1_DIGEST_LENGTH,
806 		    SHA1_DIGEST_LENGTH);
807 	} else {
808 		ssize_t n;
809 		if (lseek(pack->fd, -SHA1_DIGEST_LENGTH, SEEK_END) == -1) {
810 			err = got_error_from_errno("lseek");
811 			goto done;
812 		}
813 		n = read(pack->fd, pack_sha1_expected, SHA1_DIGEST_LENGTH);
814 		if (n == -1) {
815 			err = got_error_from_errno("read");
816 			goto done;
817 		}
818 		if (n != SHA1_DIGEST_LENGTH) {
819 			err = got_error(GOT_ERR_IO);
820 			goto done;
821 		}
822 	}
823 	if (memcmp(pack_sha1, pack_sha1_expected, SHA1_DIGEST_LENGTH) != 0) {
824 		err = got_error_msg(GOT_ERR_BAD_PACKFILE,
825 		    "bad checksum in pack file trailer");
826 		goto done;
827 	}
828 
829 	if (first_delta_idx == -1)
830 		first_delta_idx = 0;
831 
832 	/* In order to resolve ref deltas we need an in-progress pack index. */
833 	if (have_ref_deltas)
834 		make_packidx(&packidx, nobj, objects);
835 
836 	/*
837 	 * Second pass: We can now resolve deltas to compute the IDs of
838 	 * objects which appear in deltified form. Because deltas can be
839 	 * chained this pass may require a couple of iterations until all
840 	 * IDs of deltified objects have been discovered.
841 	 */
842 	pass++;
843 	while (nvalid != nobj) {
844 		int n = 0;
845 		/*
846 		 * This loop will only run once unless the pack file
847 		 * contains ref deltas which refer to objects located
848 		 * later in the pack file, which is unusual.
849 		 * Offset deltas can always be resolved in one pass
850 		 * unless the packfile is corrupt.
851 		 */
852 		for (i = first_delta_idx; i < nobj; i++) {
853 			obj = &objects[i];
854 			if (obj->type != GOT_OBJ_TYPE_REF_DELTA &&
855 			    obj->type != GOT_OBJ_TYPE_OFFSET_DELTA)
856 				continue;
857 
858 			if (obj->valid)
859 				continue;
860 
861 			if (pack->map == NULL && lseek(pack->fd,
862 			    obj->off + obj->tslen, SEEK_SET) == -1) {
863 				err = got_error_from_errno("lseek");
864 				goto done;
865 			}
866 
867 			err = resolve_deltified_object(pack, &packidx, obj,
868 			    tmpfile, delta_base_file, delta_accum_file);
869 			if (err) {
870 				if (err->code != GOT_ERR_NO_OBJ)
871 					goto done;
872 				/*
873 				 * We cannot resolve this object yet because
874 				 * a delta base is unknown. Try again later.
875 				 */
876 				continue;
877 			}
878 
879 			obj->valid = 1;
880 			n++;
881 			if (have_ref_deltas)
882 				update_packidx(&packidx, nobj, obj);
883 			/* Don't send too many progress privsep messages. */
884 			p_resolved = ((nresolved + n) * 100) / nobj;
885 			if (p_resolved != last_p_resolved) {
886 				err = send_index_pack_progress(ibuf, nobj,
887 				    nobj, nloose, nresolved + n);
888 				if (err)
889 					goto done;
890 				last_p_resolved = p_resolved;
891 			}
892 
893 		}
894 		if (pass++ > 3 && n == 0) {
895 			static char msg[64];
896 			snprintf(msg, sizeof(msg), "could not resolve "
897 			    "any of deltas; packfile could be corrupt");
898 			err = got_error_msg(GOT_ERR_BAD_PACKFILE, msg);
899 			goto done;
900 
901 		}
902 		nresolved += n;
903 		nvalid += nresolved;
904 	}
905 
906 	if (nloose + nresolved != nobj) {
907 		static char msg[64];
908 		snprintf(msg, sizeof(msg), "discovered only %d of %d objects",
909 		    nloose + nresolved, nobj);
910 		err = got_error_msg(GOT_ERR_BAD_PACKFILE, msg);
911 		goto done;
912 	}
913 
914 	err = send_index_pack_progress(ibuf, nobj, nobj, nloose, nresolved);
915 	if (err)
916 		goto done;
917 
918 	make_packidx(&packidx, nobj, objects);
919 
920 	free(objects);
921 	objects = NULL;
922 
923 	SHA1Init(&ctx);
924 	putbe32(buf, GOT_PACKIDX_V2_MAGIC);
925 	putbe32(buf + 4, GOT_PACKIDX_VERSION);
926 	err = hwrite(idxfd, buf, 8, &ctx);
927 	if (err)
928 		goto done;
929 	err = hwrite(idxfd, packidx.hdr.fanout_table,
930 	    GOT_PACKIDX_V2_FANOUT_TABLE_ITEMS * sizeof(uint32_t), &ctx);
931 	if (err)
932 		goto done;
933 	err = hwrite(idxfd, packidx.hdr.sorted_ids,
934 	    nobj * SHA1_DIGEST_LENGTH, &ctx);
935 	if (err)
936 		goto done;
937 	err = hwrite(idxfd, packidx.hdr.crc32, nobj * sizeof(uint32_t), &ctx);
938 	if (err)
939 		goto done;
940 	err = hwrite(idxfd, packidx.hdr.offsets, nobj * sizeof(uint32_t),
941 	    &ctx);
942 	if (err)
943 		goto done;
944 	if (packidx.nlargeobj > 0) {
945 		err = hwrite(idxfd, packidx.hdr.large_offsets,
946 		    packidx.nlargeobj * sizeof(uint64_t), &ctx);
947 		if (err)
948 			goto done;
949 	}
950 	err = hwrite(idxfd, pack_sha1, SHA1_DIGEST_LENGTH, &ctx);
951 	if (err)
952 		goto done;
953 
954 	SHA1Final(packidx_hash, &ctx);
955 	w = write(idxfd, packidx_hash, sizeof(packidx_hash));
956 	if (w == -1) {
957 		err = got_error_from_errno("write");
958 		goto done;
959 	}
960 	if (w != sizeof(packidx_hash)) {
961 		err = got_error(GOT_ERR_IO);
962 		goto done;
963 	}
964 done:
965 	free(objects);
966 	free(packidx.hdr.magic);
967 	free(packidx.hdr.version);
968 	free(packidx.hdr.fanout_table);
969 	free(packidx.hdr.sorted_ids);
970 	free(packidx.hdr.offsets);
971 	free(packidx.hdr.large_offsets);
972 	return err;
973 }
974 
975 int
976 main(int argc, char **argv)
977 {
978 	const struct got_error *err = NULL, *close_err;
979 	struct imsgbuf ibuf;
980 	struct imsg imsg;
981 	size_t i;
982 	int idxfd = -1, tmpfd = -1;
983 	FILE *tmpfiles[3];
984 	struct got_pack pack;
985 	uint8_t pack_hash[SHA1_DIGEST_LENGTH];
986 	off_t packfile_size;
987 #if 0
988 	static int attached;
989 	while (!attached)
990 		sleep(1);
991 #endif
992 
993 	for (i = 0; i < nitems(tmpfiles); i++)
994 		tmpfiles[i] = NULL;
995 
996 	memset(&pack, 0, sizeof(pack));
997 	pack.fd = -1;
998 	pack.delta_cache = got_delta_cache_alloc(500,
999 	    GOT_DELTA_RESULT_SIZE_CACHED_MAX);
1000 	if (pack.delta_cache == NULL) {
1001 		err = got_error_from_errno("got_delta_cache_alloc");
1002 		goto done;
1003 	}
1004 
1005 	imsg_init(&ibuf, GOT_IMSG_FD_CHILD);
1006 #ifndef PROFILE
1007 	/* revoke access to most system calls */
1008 	if (pledge("stdio recvfd", NULL) == -1) {
1009 		err = got_error_from_errno("pledge");
1010 		got_privsep_send_error(&ibuf, err);
1011 		return 1;
1012 	}
1013 #endif
1014 	err = got_privsep_recv_imsg(&imsg, &ibuf, 0);
1015 	if (err)
1016 		goto done;
1017 	if (imsg.hdr.type == GOT_IMSG_STOP)
1018 		goto done;
1019 	if (imsg.hdr.type != GOT_IMSG_IDXPACK_REQUEST) {
1020 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1021 		goto done;
1022 	}
1023 	if (imsg.hdr.len - IMSG_HEADER_SIZE != sizeof(pack_hash)) {
1024 		err = got_error(GOT_ERR_PRIVSEP_LEN);
1025 		goto done;
1026 	}
1027 	memcpy(pack_hash, imsg.data, sizeof(pack_hash));
1028 	pack.fd = imsg.fd;
1029 
1030 	err = got_privsep_recv_imsg(&imsg, &ibuf, 0);
1031 	if (err)
1032 		goto done;
1033 	if (imsg.hdr.type == GOT_IMSG_STOP)
1034 		goto done;
1035 	if (imsg.hdr.type != GOT_IMSG_IDXPACK_OUTFD) {
1036 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1037 		goto done;
1038 	}
1039 	if (imsg.hdr.len - IMSG_HEADER_SIZE != 0) {
1040 		err = got_error(GOT_ERR_PRIVSEP_LEN);
1041 		goto done;
1042 	}
1043 	idxfd = imsg.fd;
1044 
1045 	for (i = 0; i < nitems(tmpfiles); i++) {
1046 		err = got_privsep_recv_imsg(&imsg, &ibuf, 0);
1047 		if (err)
1048 			goto done;
1049 		if (imsg.hdr.type == GOT_IMSG_STOP)
1050 			goto done;
1051 		if (imsg.hdr.type != GOT_IMSG_TMPFD) {
1052 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1053 			goto done;
1054 		}
1055 		if (imsg.hdr.len - IMSG_HEADER_SIZE != 0) {
1056 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1057 			goto done;
1058 		}
1059 		tmpfd = imsg.fd;
1060 		tmpfiles[i] = fdopen(tmpfd, "w+");
1061 		if (tmpfiles[i] == NULL) {
1062 			err = got_error_from_errno("fdopen");
1063 			goto done;
1064 		}
1065 		tmpfd = -1;
1066 	}
1067 
1068 	if (lseek(pack.fd, 0, SEEK_END) == -1) {
1069 		err = got_error_from_errno("lseek");
1070 		goto done;
1071 	}
1072 	packfile_size = lseek(pack.fd, 0, SEEK_CUR);
1073 	if (packfile_size == -1) {
1074 		err = got_error_from_errno("lseek");
1075 		goto done;
1076 	}
1077 	pack.filesize = packfile_size; /* XXX off_t vs size_t */
1078 
1079 	if (lseek(pack.fd, 0, SEEK_SET) == -1) {
1080 		err = got_error_from_errno("lseek");
1081 		goto done;
1082 	}
1083 
1084 #ifndef GOT_PACK_NO_MMAP
1085 	pack.map = mmap(NULL, pack.filesize, PROT_READ, MAP_PRIVATE,
1086 	    pack.fd, 0);
1087 	if (pack.map == MAP_FAILED)
1088 		pack.map = NULL; /* fall back to read(2) */
1089 #endif
1090 	err = index_pack(&pack, idxfd, tmpfiles[0], tmpfiles[1], tmpfiles[2],
1091 	    pack_hash, &ibuf);
1092 done:
1093 	close_err = got_pack_close(&pack);
1094 	if (close_err && err == NULL)
1095 		err = close_err;
1096 	if (idxfd != -1 && close(idxfd) == -1 && err == NULL)
1097 		err = got_error_from_errno("close");
1098 	if (tmpfd != -1 && close(tmpfd) == -1 && err == NULL)
1099 		err = got_error_from_errno("close");
1100 	for (i = 0; i < nitems(tmpfiles); i++) {
1101 		if (tmpfiles[i] != NULL && fclose(tmpfiles[i]) == EOF &&
1102 		    err == NULL)
1103 			err = got_error_from_errno("fclose");
1104 	}
1105 
1106 	if (err == NULL)
1107 		err = send_index_pack_done(&ibuf);
1108 	if (err) {
1109 		got_privsep_send_error(&ibuf, err);
1110 		fprintf(stderr, "%s: %s\n", getprogname(), err->msg);
1111 		got_privsep_send_error(&ibuf, err);
1112 		exit(1);
1113 	}
1114 
1115 	exit(0);
1116 }