Corrected buffer overflow during automatic checkpoint in fast-import.

If we previously were using a delta but we needed to checkpoint the
current packfile and switch to a new packfile we need to throw away
the delta and compress the raw object by itself, as delta chains
cannot span non-thin packfiles.  Unfortunately the output buffer
in this case needs to grow, as the size of the compressed object
may be quite a bit larger than the size of the compressed delta.

I've also avoided recompressing the object if we are checkpointing
and we didn't use a delta.  In this case the output buffer is the
correct size and has already been populated with the right data,
we just need to close out the current packfile and open a new one.

Signed-off-by: Shawn O. Pearce <spearce@spearce.org>

diff --git a/fast-import.c b/fast-import.c
index 19d01e20adda0ab0f614fca763dfd1d479255535..57d857c386c9c1a34030d10e7a4bef19722413c6 100644 (file)
--- a/fast-import.c
+++ b/fast-import.c
@@ -847,16 +847,17 @@ static int store_object(
                if (delta) {
                        free(delta);
                        delta = NULL;
+
+                       memset(&s, 0, sizeof(s));
+                       deflateInit(&s, zlib_compression_level);
+                       s.next_in = dat;
+                       s.avail_in = datlen;
+                       s.avail_out = deflateBound(&s, s.avail_in);
+                       s.next_out = out = xrealloc(out, s.avail_out);
+                       while (deflate(&s, Z_FINISH) == Z_OK)
+                               /* nothing */;
+                       deflateEnd(&s);
                }
-               memset(&s, 0, sizeof(s));
-               deflateInit(&s, zlib_compression_level);
-               s.next_in = dat;
-               s.avail_in = datlen;
-               s.avail_out = deflateBound(&s, s.avail_in);
-               s.next_out = out;
-               while (deflate(&s, Z_FINISH) == Z_OK)
-                       /* nothing */;
-               deflateEnd(&s);
        }
 
        e->type = type;