commit - 402a5ec1f96e30e83525c0e1509f854a706d1066
commit + 3976db154b362a2b110c8dba0c44d1845f9a6e90
blob - a0306114c68e819c0550e81661abc0b5fc91994d
blob + 4a1a3b5a468f64d961a00092f1e31c7840fa0674
--- lib/pack.c
+++ lib/pack.c
return got_error(GOT_ERR_NO_SPACE);
if (pack->map) {
+ if (mapoff + sizeof(sizeN) >= pack->filesize)
+ return got_error(GOT_ERR_BAD_PACKFILE);
sizeN = *(pack->map + mapoff);
mapoff += sizeof(sizeN);
} else {
if (pack->map) {
size_t mapoff;
- if (delta_offset >= pack->filesize)
- return got_error(GOT_ERR_PACK_OFFSET);
mapoff = (size_t)delta_offset + *len;
+ if (mapoff + sizeof(offN) >= pack->filesize)
+ return got_error(GOT_ERR_PACK_OFFSET);
offN = *(pack->map + mapoff);
} else {
ssize_t n;
{
if (pack->map) {
size_t mapoff = delta_offset + tslen;
+ if (mapoff + sizeof(*id) >= pack->filesize)
+ return got_error(GOT_ERR_PACK_OFFSET);
memcpy(id, pack->map + mapoff, sizeof(*id));
} else {
ssize_t n;