Skip to content

detect delta cycles in resolve_object#2299

Open
netliomax25-code wants to merge 1 commit into
jelmer:mainfrom
netliomax25-code:pack-delta-cycle-detection
Open

detect delta cycles in resolve_object#2299
netliomax25-code wants to merge 1 commit into
jelmer:mainfrom
netliomax25-code:pack-delta-cycle-detection

Conversation

@netliomax25-code

Copy link
Copy Markdown
Contributor
  1. Pack.resolve_object walks a pack object's delta chain, but the only cycle guard rejects a single self-referencing REF_DELTA (base_offset == prev_offset), so a pack holding two or more REF_DELTA objects that name each other is not caught.
  2. get_raw drives that walk, so reading such an object never returns: each iteration re-inflates a delta and appends to delta_stack, so memory grows without bound. A pack file is untrusted input (a cloned or downloaded repository, a submodule, a pack read from disk). git index-pack and dulwich's own streaming DeltaChainIterator both reject delta cycles; only this random-access path did not.
  3. Track the REF_DELTA base offsets already followed on the chain and raise UnresolvedDeltas when one repeats. Every cycle crosses at least one REF_DELTA edge (OFS_DELTA offsets strictly decrease), so this is enough to break any cycle, and valid chains visit distinct offsets so their result is unchanged.

Verified with a two-object REF_DELTA cycle: before the change get_raw hangs; after it raises UnresolvedDeltas. Added a regression test covering that pack.

@netliomax25-code netliomax25-code requested a review from jelmer as a code owner July 11, 2026 18:33
@jelmer

jelmer commented Jul 11, 2026

Copy link
Copy Markdown
Owner

What does C Git do here?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants