Mercurial > hg-stable

changeset 37867:59837a16896d stable

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mpatch: avoid integer overflow in mpatch_decode (SEC)
author Augie Fackler <augie@google.com>
date Mon, 30 Apr 2018 22:23:06 -0400
parents 7f22ef3c0ee7
children 9c5ced5276d6
files mercurial/mpatch.c
diffstat 1 files changed, 8 insertions(+), 3 deletions(-) [+]
line wrap: on
line diff
--- a/mercurial/mpatch.c	Mon Apr 30 22:20:13 2018 -0400
+++ b/mercurial/mpatch.c	Mon Apr 30 22:23:06 2018 -0400
@@ -285,10 +285,15 @@
 		lt->start = getbe32(bin + pos);
 		lt->end = getbe32(bin + pos + 4);
 		lt->len = getbe32(bin + pos + 8);
-		lt->data = bin + pos + 12;
-		pos += 12 + lt->len;
-		if (lt->start > lt->end || lt->len < 0)
+		if (lt->start < 0 || lt->start > lt->end || lt->len < 0)
 			break; /* sanity check */
+		if (!safeadd(12, &pos)) {
+			break;
+		}
+		lt->data = bin + pos;
+		if (!safeadd(lt->len, &pos)) {
+			break;
+		}
 		lt++;
 	}