read_istream_pack_non_delta(): document input handling

Twice now we have scratched our heads about why the loose streaming code
needs the protection added by 692f0bc7ae (avoid infinite loop in
read_istream_loose, 2013-03-25), but the similar code in its pack
counterpart does not.

The short answer is that use_pack() will die before it lets us run out
of bytes. Note that this could mean reading garbage (including the
trailing hash) from the packfile in some cases of corruption, but that's
OK. zlib will notice and complain (and if not, certainly the end result
will not match the object hash we expect).

Let's leave a comment this time to document our findings.

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/streaming.c b/streaming.c
index d1e6b2dce6877cb1407ac9d38e65d8b2bae25daa..ac7c7a22f90b7320a235f23db9387fd91ba5b2cd 100644 (file)
--- a/streaming.c
+++ b/streaming.c
@@ -408,6 +408,15 @@ static read_method_decl(pack_non_delta)
                        st->z_state = z_done;
                        break;
                }
+
+               /*
+                * Unlike the loose object case, we do not have to worry here
+                * about running out of input bytes and spinning infinitely. If
+                * we get Z_BUF_ERROR due to too few input bytes, then we'll
+                * replenish them in the next use_pack() call when we loop. If
+                * we truly hit the end of the pack (i.e., because it's corrupt
+                * or truncated), then use_pack() catches that and will die().
+                */
                if (status != Z_OK && status != Z_BUF_ERROR) {
                        git_inflate_end(&st->z);
                        st->z_state = z_error;