Han Xin [off-list ref] writes:
quoted hunk
@@ -519,6 +520,8 @@ static void *unpack_raw_entry(struct object_entry *obj,
shift += 7;
}
obj->size = size;
+ if (max_input_object_size && size > max_input_object_size)
+ die(_("object exceeds maximum allowed size "));
switch (obj->type) {
case OBJ_REF_DELTA:
Here obj->size is the inflated payload size of a single entry in the
packfile. If it happens to be represented as a base object
(i.e. without delta, just deflated), it would be close to the size
of the blob in the working tree (but LF->CRLF conversion and the
like may further inflate it), but if it is a delta object, this size
is just the size of the delta data we feed patch_delta() with, and
has no relevance to the actual "file size".
Sure, it is called max_INPUT_object_size and we can say we are not
limiting the final disk size, and that might be a workable excuse
to check based on the obj->size here, but then its usefulness from
the point of view of end users, who decide to set the variable to
limit "some" usage, becomes dubious.
So...