DOG-014: `PACKResolveOfs` ping-pong sizing — undocumented invariant, latent heap overflow

Now: OPEN
Sev: MED

dog/git/PACK.c's PACKResolveOfs applies the delta chain bottom-up, ping-ponging the apply result between delta[0]+half and base[0] (PACK.c:265-285), where half = deltalen/2 (:213). Every DELTApply output gauge is {dst,dst,dst+half} (:278), so when dst == base[0] up to half bytes may be written into the base scratch — which is baselen bytes. Safety therefore REQUIRES half <= baselen, i.e. deltalen <= 2*baselen, and NOTHING checks or documents it. A symmetric over-read exists via bsl = {src, src+outsz} (:277). Latent today (keeper KEEP.c:428-429 and the tests size both scratches equally, so half = baselen/2 < baselen), but a future caller giving a larger delta scratch than base scratch gets an attacker-result_sz-driven heap overflow. Distinct from the keeper-side MEM-022/GIT-004 resolver work — this bug is in the surviving OFS apply loop in dog/git. Method: Issues.

Input

Context

PACK.c:213 half = deltalen/2; apply gauge :278 bounded by half, not by base's real capacity baselen; ping-pong flip :285.
DELTApply bounds writes by u8gRestLen(out)==half (DELT.c:32), so it can fill half bytes into a baselen-byte buffer if half>baselen.
Current callers safe by convention only (equal buffers) — no guard, no doc.
Related: DELTApply reads base_sz (DELT.c:29) but never validates it against $size(base) (git does); harmless memory-wise (copy opcodes are bounds-checked at DELT.c:52-53) but lets malformed deltas through.

Goals

Add if (half > baselen) return NOROOM; (or size the apply gauge to min(half, baselen)), and state the deltalen <= 2*baselen contract in PACK.h.
Validate base_sz == $size(base) in DELTApply and fail malformed deltas.

Constraints

dog/git libdog, ABC style; success path byte-identical for equal-buffer callers (keeper, tests).

WIP

Design decisions

Prefer the explicit guard + documented invariant over silently clamping, so a mis-sized caller fails loudly instead of truncating a valid object.

TODOs

T1 repro: a PACKResolveOfs call with deltalen > 2*baselen and a delta whose intermediate result_sz lands in (baselen, half]; assert it errors rather than overflowing (ASan). Add to dog/fuzz/PACKRESOLVE.c.
T2 add the half <= baselen guard + PACK.h invariant note.
T3 base_sz validation in DELTApply.

Blockers and bummers

GIT-004 deletes the REF_DELTA arm but the OFS apply loop (this bug) survives.
Audit 2026-07-07: re-verified in libdog HEAD 79612854 — half = deltalen/2 PACK.c:213, apply gauge bounded by half not baselen, no half<=baselen guard. NOTHING landed; the exact guard + comment ARE implemented in worktree ~/src/DOG-014 (git/PACK.c), UNLANDED.

Outcome

OPEN — filed 2026-07-06, the libdog code-quality review session.

DOG-014: PACKResolveOfs ping-pong sizing — undocumented invariant, latent heap overflow