use std::io; use gix_features::decode::leb64_from_read; use super::{BLOB, COMMIT, OFS_DELTA, REF_DELTA, TAG, TREE};use crate::data; fn corrupt(message: &'static str) -> gix_error::CorruptionError {    gix_error::CorruptionError::new(format!("Pack entry is truncated: {message}"))} /// Decodingimpl data::Entry {    /// Decode an entry from the given entry data `d`, providing the `pack_offset` to allow tracking the start of the entry data section.    pub fn from_bytes(        d: &[u8],        pack_offset: data::Offset,        object_hash: gix_hash::Kind,    ) -> Result<data::Entry, gix_error::CorruptionError> {        let (type_id, size, mut consumed) = parse_header_info(d)?;        let hash_len = object_hash.len_in_bytes();         use crate::data::entry::Header::*;        let object = match type_id {            OFS_DELTA => {                let (distance, leb_bytes) = parse_leb64(&d[consumed..])?;                let delta = OfsDelta {                    base_distance: distance,                };                consumed += leb_bytes;                delta            }            REF_DELTA => {                let hash = d                    .get(consumed..)                    .and_then(|d| d.get(..hash_len))                    .ok_or_else(|| corrupt("ref-delta base object id"))?;                let delta = RefDelta {                    base_id: gix_hash::ObjectId::try_from(hash)                        .map_err(|_| corrupt("unsupported object hash length"))?,                };                consumed += hash_len;                delta            }            BLOB => Blob,            TREE => Tree,            COMMIT => Commit,            TAG => Tag,            other => {                return Err(gix_error::CorruptionError::new(format!(                    "Object type {other} is unsupported"                )));            }        };        Ok(data::Entry {            header: object,            decompressed_size: size,            data_offset: pack_offset + consumed as u64,            encoded_header_size: encoded_header_size(consumed)?,        })    }     /// Instantiate an `Entry` from the reader `r`, providing the `pack_offset` to allow tracking the start of the entry data section.    pub fn from_read(r: &mut dyn io::Read, pack_offset: data::Offset, hash_len: usize) -> io::Result<data::Entry> {        let (type_id, size, mut consumed) = streaming_parse_header_info(r)?;         use crate::data::entry::Header::*;        let object = match type_id {            OFS_DELTA => {                let (distance, leb_bytes) = leb64_from_read(&mut *r)?;                let delta = OfsDelta {                    base_distance: distance,                };                consumed += leb_bytes;                delta            }            REF_DELTA => {                let mut buf = gix_hash::Kind::buf();                let hash = &mut buf[..hash_len];                r.read_exact(hash)?;                #[allow(clippy::redundant_slicing)]                let delta = RefDelta {                    base_id: gix_hash::ObjectId::from_bytes_or_panic(&hash[..]),                };                consumed += hash_len;                delta            }            BLOB => Blob,            TREE => Tree,            COMMIT => Commit,            TAG => Tag,            other => return Err(io::Error::other(format!("Object type {other} is unsupported"))),        };        Ok(data::Entry {            header: object,            decompressed_size: size,            data_offset: pack_offset + consumed as u64,            encoded_header_size: encoded_header_size(consumed)                .map_err(|err| io::Error::new(io::ErrorKind::InvalidData, err))?,        })    }} fn encoded_header_size(consumed: usize) -> Result<u16, gix_error::CorruptionError> {    consumed        .try_into()        .map_err(|_| corrupt("entry header size does not fit into u16"))} #[inline]fn streaming_parse_header_info(read: &mut dyn io::Read) -> Result<(u8, u64, usize), io::Error> {    let mut byte = [0u8; 1];    read.read_exact(&mut byte)?;    let mut c = byte[0];    let mut i = 1;    let type_id = (c >> 4) & 0b0000_0111;    let mut size = u64::from(c) & 0b0000_1111;    let mut shift = 4u32;    while c & 0b1000_0000 != 0 {        read.read_exact(&mut byte)?;        c = byte[0];        i += 1;        let component = u64::from(c & 0b0111_1111)            .checked_shl(shift)            .ok_or_else(|| io::Error::new(io::ErrorKind::InvalidData, "pack entry header overflowed"))?;        size = size            .checked_add(component)            .ok_or_else(|| io::Error::new(io::ErrorKind::InvalidData, "pack entry header overflowed"))?;        shift += 7;    }    Ok((type_id, size, i))} /// Parses the header of a pack-entry, yielding object type id, decompressed object size, and consumed bytes#[inline]fn parse_header_info(data: &[u8]) -> Result<(u8, u64, usize), gix_error::CorruptionError> {    let mut c = *data        .first()        .ok_or_else(|| corrupt("need a pack entry header, got empty input"))?;    let mut i = 1;    let type_id = (c >> 4) & 0b0000_0111;    let mut size = u64::from(c) & 0b0000_1111;    let mut shift = 4u32;    while c & 0b1000_0000 != 0 {        c = *data            .get(i)            .ok_or_else(|| corrupt("pack entry header continuation byte"))?;        i += 1;        let component = u64::from(c & 0b0111_1111)            .checked_shl(shift)            .ok_or_else(|| gix_error::CorruptionError::new("Pack entry header value overflowed while decoding"))?;        size = size            .checked_add(component)            .ok_or_else(|| gix_error::CorruptionError::new("Pack entry header value overflowed while decoding"))?;        shift += 7;    }    Ok((type_id, size, i))} fn parse_leb64(data: &[u8]) -> Result<(u64, usize), gix_error::CorruptionError> {    let mut i = 0;    let mut c = *data.first().ok_or_else(|| corrupt("an ofs-delta base distance"))?;    i += 1;    let mut value = u64::from(c) & 0x7f;    while c & 0x80 != 0 {        c = *data            .get(i)            .ok_or_else(|| corrupt("an ofs-delta base distance continuation byte"))?;        i += 1;        value = value            .checked_add(1)            .and_then(|value| value.checked_shl(7))            .and_then(|value| value.checked_add(u64::from(c) & 0x7f))            .ok_or_else(|| gix_error::CorruptionError::new("Pack entry header value overflowed while decoding"))?;    }    Ok((value, i))} #[cfg(test)]mod tests {    use super::*;     #[test]    fn accepts_non_canonical_pack_entry_header_encoding() {        let pack_offset = 42;        let entry = data::Entry::from_bytes(&[0xb3, 0x00], pack_offset, gix_hash::Kind::Sha1)            .expect("non-canonical size encodings are accepted by git");         assert_eq!(entry.header, data::entry::Header::Blob);        assert_eq!(            entry.decompressed_size, 3,            "`0xb3` is `1011_0011`: the low nibble `0011` is size 3, and the continued `0x00` adds no size bits"        );        assert_eq!(            entry.encoded_header_size, 2,            "the decoded entry records the actual encoded header length, not the canonical length, and has an extra byte 0x00"        );        assert_eq!(            entry.header.size(entry.decompressed_size),            1,            "canonical re-encoding of a blob with size 3 needs only the single byte `0x33`"        );        assert_eq!(            entry.header_size(),            2,            "`header_size()` reports the two bytes actually consumed from `b3 00`, unlike `Header::size()` which canonicalizes to one byte"        );        assert_eq!(entry.pack_offset(), pack_offset);        assert_eq!(entry.data_offset, pack_offset + 2);    }     #[test]    fn non_canonical_pack_entry_header_keeps_ofs_delta_base_offsets_correct() {        let pack_offset = 100;        let base_distance = 5;        let entry = data::Entry::from_bytes(&[0xe4, 0x00, base_distance], pack_offset, gix_hash::Kind::Sha1)            .expect("non-canonical ofs-delta size encodings are accepted by git");         assert_eq!(            entry.header,            data::entry::Header::OfsDelta {                base_distance: base_distance.into()            },            "the base_distance is correct, which wouldn't be the case without using the consumed size"        );        assert_eq!(            entry.header_size(),            3,            "`e4 00` consumes two size-header bytes before the one-byte ofs-delta base distance. entry.size() would be 2"        );        assert_eq!(            entry.pack_offset(),            pack_offset,            "`pack_offset()` subtracts the actual three-byte header from `data_offset`, preserving the entry start"        );        assert_eq!(            entry.checked_base_pack_offset(base_distance.into()),            Some(pack_offset - u64::from(base_distance)),            "ofs-delta base distances are relative to the entry start, so preserving `pack_offset()` keeps the base lookup correct"        );    }     #[test]    fn oversized_encoded_header_size_is_rejected() {        assert_eq!(            encoded_header_size(usize::from(u16::MAX) + 1)                .expect_err("the encoded size exceeds u16")                .to_string(),            "Pack entry is truncated: entry header size does not fit into u16",            "entry header lengths that cannot be stored in the Entry metadata must be rejected"        );    }}