Commit Graph
1 Commits
Author SHA1 Message Date
Omar Elsayed 9dc0ff638c Bound aligned_i by s->count in hash_search() (--inplace) (#1133)
When updating_basis_file is active (--inplace), hash_search() advances
aligned_offset by s->blength and increments the 32-bit signed counter
aligned_i until aligned_offset catches up to offset.

If the source file is larger than 2 GiB and the peer supplies a small
s->blength and s->count, continuing to increment aligned_i past s->count
serves no purpose (as no basis blocks exist beyond s->count - 1) and can
overflow INT32_MAX into a negative index that bypasses the one-sided
aligned_i < s->count check.

Stop the catch-up loop once aligned_i reaches s->count so aligned_i
remains strictly within [0, s->count] and cannot overflow.

Reported-by: Mominul Islam Hemal <mominulislam-2021411216@cs.du.ac.bd>
2026-10-19 19:15:10 +10:00