--- a/mercurial/bdiff.c Tue May 15 22:36:27 2012 +0200
+++ b/mercurial/bdiff.c Tue May 15 22:36:47 2012 +0200
@@ -381,9 +381,18 @@
for (h = l.next; h; h = h->next) {
if (h->a1 != la || h->b1 != lb) {
len = bl[h->b1].l - bl[lb].l;
- putbe32(al[la].l - al->l, rb);
- putbe32(al[h->a1].l - al->l, rb + 4);
- putbe32(len, rb + 8);
+
+#define checkputbe32(__x, __c) \
+ if (__x > UINT_MAX) { \
+ PyErr_SetString(PyExc_ValueError, \
+ "bdiff: value too large for putbe32"); \
+ goto nomem; \
+ } \
+ putbe32((uint32_t)(__x), __c);
+
+ checkputbe32(al[la].l - al->l, rb);
+ checkputbe32(al[h->a1].l - al->l, rb + 4);
+ checkputbe32(len, rb + 8);
memcpy(rb + 12, bl[lb].l, len);
rb += 12 + len;
}