Fix array overflow bug in bdiff
author"Wallace, Eric S" <eric.s.wallace@intel.com>
Thu, 04 Aug 2005 13:25:59 -0800
changeset 827 a61728b58dc0
parent 826 16700cdd9055
child 836 1fe3b14c7044
Fix array overflow bug in bdiff I ran into a bug while importing a large repository into mercurial. The diff algorithm does not allocate a big enough array of hunks for some test cases. This results in memory corruption, and possibly, as in my case, a seg fault. You should be able to reproduce this problem with any case of more than a few lines that follows this pattern: a b = = 1 1 2 2 3 4 3 5 . 4 . . 5 . . . I.e., "a" has blank lines on every other line that have been removed in "b". In this case, the number of matching hunks is equal to the number of lines in "b". This is more than ((an + bn)/4 + 2). I'm not sure what motivates this formula, but when I changed it to the smaller of an or bn (+ 1), it works. [comment added by mpm]
mercurial/bdiff.c
--- a/mercurial/bdiff.c	Thu Aug 04 13:22:36 2005 -0800
+++ b/mercurial/bdiff.c	Thu Aug 04 13:25:59 2005 -0800
@@ -229,7 +229,8 @@
 	/* allocate and fill arrays */
 	t = equatelines(a, an, b, bn);
 	pos = calloc(bn, sizeof(struct pos));
-	l.head = l.base = malloc(sizeof(struct hunk) * ((an + bn) / 4 + 2));
+	/* we can't have more matches than lines in the shorter file */
+	l.head = l.base = malloc(sizeof(struct hunk) * ((an<bn ? an:bn) + 1));
 
 	if (pos && l.base && t) {
 		/* generate the matching block list */