I would add a check here and in OBJ_REF_DELTA. If the delta instruction size "sz" is larger than maxObjectSizeLimit, I would abort. That is a massive instruction stream that you do not want the server to attempt to process. Unfortunately you cannot get a SHA-1 at this point in time, because the delta cannot be inflated. But this max object size limit is about protecting the server repository from large garbage sent by a user, so we should abort earlier rather than later on an input.