Fix parsing of @{-1}@{1}

diff --git a/builtin-unpack-objects.c b/builtin-unpack-objects.c
index d2796b6309d3b13a6c401b502aafd53d684328d8..47ed610677fe47f855beaac02f40fa84d132455e 100644 (file)
--- a/builtin-unpack-objects.c
+++ b/builtin-unpack-objects.c
@@ -370,6 +370,8 @@ static void unpack_delta_entry(enum object_type type, unsigned long delta_size,
                        base_offset = (base_offset << 7) + (c & 127);
                }
                base_offset = obj_list[nr].offset - base_offset;
+               if (base_offset <= 0 || base_offset >= obj_list[nr].offset)
+                       die("offset value out of bound for delta base object");
 
                delta_data = get_data(delta_size);
                if (dry_run || !delta_data) {
@@ -477,8 +479,7 @@ static void unpack_all(void)
 
        if (!quiet)
                progress = start_progress("Unpacking objects", nr_objects);
-       obj_list = xmalloc(nr_objects * sizeof(*obj_list));
-       memset(obj_list, 0, nr_objects * sizeof(*obj_list));
+       obj_list = xcalloc(nr_objects, sizeof(*obj_list));
        for (i = 0; i < nr_objects; i++) {
                unpack_one(i);
                display_progress(progress, i + 1);