PACKResolveOfs ping-pong sizing — undocumented invariant, latent heap overflow
dog/git/PACK.c's PACKResolveOfs applies the delta chain bottom-up, ping-ponging the apply result between delta[0]+half and base[0] (PACK.c:265-285), where half = deltalen/2 (:213). Every DELTApply output gauge is {dst,dst,dst+half} (:278), so when dst == base[0] up to half bytes may be written into the base scratch — which is baselen bytes. Safety therefore REQUIRES half <= baselen, i.e. deltalen <= 2*baselen, and NOTHING checks or documents it. A symmetric over-read exists via bsl = {src, src+outsz} (:277). Latent today (keeper KEEP.c:428-429 and the tests size both scratches equally, so half = baselen/2 < baselen), but a future caller giving a larger delta scratch than base scratch gets an attacker-result_sz-driven heap overflow. Distinct from the keeper-side MEM-022/GIT-004 resolver work — this bug is in the surviving OFS apply loop in dog/git. Method: Issues.
PACK.c:213 half = deltalen/2; apply gauge :278 bounded by half, not by
base's real capacity baselen; ping-pong flip :285.
DELTApply bounds writes by u8gRestLen(out)==half (DELT.c:32), so it can
fill half bytes into a baselen-byte buffer if half>baselen.
DELTApply reads base_sz (DELT.c:29) but never validates it
against $size(base) (git does); harmless memory-wise (copy opcodes are bounds-checked at DELT.c:52-53) but lets malformed deltas through.
if (half > baselen) return NOROOM; (or size the apply gauge to
min(half, baselen)), and state the deltalen <= 2*baselen contract in PACK.h.
base_sz == $size(base) in DELTApply and fail malformed deltas.dog/git libdog, ABC style; success path byte-identical for equal-buffercallers (keeper, tests).
mis-sized caller fails loudly instead of truncating a valid object.
PACKResolveOfs call with deltalen > 2*baselen and a delta
whose intermediate result_sz lands in (baselen, half]; assert it errors rather than overflowing (ASan). Add to dog/fuzz/PACKRESOLVE.c.
half <= baselen guard + PACK.h invariant note.base_sz validation in DELTApply.79612854 — half = deltalen/2 PACK.c:213, apply gauge bounded by half not baselen, no half<=baselen guard. NOTHING landed; the exact guard + comment ARE implemented in worktree ~/src/DOG-014 (git/PACK.c), UNLANDED.