changeset 37861:1acfc35d478c stable

mpatch: protect against underflow in mpatch_apply (SEC) Also caught by oss-fuzz fuzzer during development. This defect is OVE-20180430-0002. A CVE has not been obtained as of this writing.
author Augie Fackler <augie@google.com>
date Sat, 28 Apr 2018 02:04:56 -0400
parents 90a274965de7
children faa924469635
files mercurial/mpatch.c
diffstat 1 files changed, 4 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/mercurial/mpatch.c	Sat Apr 28 00:42:16 2018 -0400
+++ b/mercurial/mpatch.c	Sat Apr 28 02:04:56 2018 -0400
@@ -248,7 +248,7 @@
 	char *p = buf;
 
 	while (f != l->tail) {
-		if (f->start < last || f->end > len) {
+		if (f->start < last || f->end > len || last < 0) {
 			return MPATCH_ERR_INVALID_PATCH;
 		}
 		memcpy(p, orig + last, f->start - last);
@@ -258,6 +258,9 @@
 		p += f->len;
 		f++;
 	}
+	if (last < 0) {
+		return MPATCH_ERR_INVALID_PATCH;
+	}
 	memcpy(p, orig + last, len - last);
 	return 0;
 }