GHSA-35mr-4567-66vg: Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution

A High-severity Denial of Service (DoS) vulnerability exists in the Pack.resolve_object method. When resolving an OFS_DELTA object, the resolver calculates the base offset using base_offset = obj_offset - delta_offset.

If a malicious packfile contains an OFS_DELTA object where delta_offset is 0, the calculation obj_offset - 0 resolves back to the current object’s own offset. Because the implementation lacks a depth counter, a “visited” set, or an explicit rejection of delta_offset == 0, the resolver enters an infinite recursive loop, exhausting CPU resources and eventually crashing the process.

Vulnerable Code Breakdown (dulwich/pack.py):

elif obj_type == OFS_DELTA:
delta_offset = parse_pack_object_offset_at(...)
base_offset = obj_offset - delta_offset          # VULNERABILITY: Self-reference if delta_offset == 0
base_type, base_data = self.resolve_object(...)  # VULNERABILITY: Infinite recursion