Merge branch 'sg/test-BUG'

diff --git a/midx.c b/midx.c
index a50b117b777d2659a6d930997ced4f43fbbc3e46..2a6a24fcd7eff1a074c37e6c556f2143ef134c19 100644 (file)
--- a/midx.c
+++ b/midx.c
@@ -202,7 +202,7 @@ int prepare_midx_pack(struct multi_pack_index *m, uint32_t pack_int_id)
        struct strbuf pack_name = STRBUF_INIT;
 
        if (pack_int_id >= m->num_packs)
-               die(_("bad pack-int-id: %u (%u total packs"),
+               die(_("bad pack-int-id: %u (%u total packs)"),
                    pack_int_id, m->num_packs);
 
        if (m->packs[pack_int_id])
@@ -721,12 +721,18 @@ static size_t write_midx_object_offsets(struct hashfile *f, int large_offset_nee
 static size_t write_midx_large_offsets(struct hashfile *f, uint32_t nr_large_offset,
                                       struct pack_midx_entry *objects, uint32_t nr_objects)
 {
-       struct pack_midx_entry *list = objects;
+       struct pack_midx_entry *list = objects, *end = objects + nr_objects;
        size_t written = 0;
 
        while (nr_large_offset) {
-               struct pack_midx_entry *obj = list++;
-               uint64_t offset = obj->offset;
+               struct pack_midx_entry *obj;
+               uint64_t offset;
+
+               if (list >= end)
+                       BUG("too many large-offset objects");
+
+               obj = list++;
+               offset = obj->offset;
 
                if (!(offset >> 31))
                        continue;