comparison mercurial/mpatch.c @ 38187:90a274965de7 stable

mpatch: be more careful about parsing binary patch data (SEC)

It appears to have been possible to trivially walk off the end of an
allocated region with a malformed patch. Oops.

Caught when writing an mpatch fuzzer for oss-fuzz.

This defect is OVE-20180430-0001. A CVE has not been obtained as of
this writing.

38186:c0081d3e1598

	if (!l)
		return MPATCH_ERR_NO_MEM;

	lt = l->tail;

	while (pos >= 0 && pos < len) {
		lt->start = getbe32(bin + pos);
		lt->end = getbe32(bin + pos + 4);
		lt->len = getbe32(bin + pos + 8);
		lt->data = bin + pos + 12;
		pos += 12 + lt->len;

38187:90a274965de7

	if (!l)
		return MPATCH_ERR_NO_MEM;

	lt = l->tail;

	/* We check against len-11 to ensure we have at least 12 bytes
	   left in the patch so we can read our three be32s out of it. */
	while (pos >= 0 && pos < (len - 11)) {
		lt->start = getbe32(bin + pos);
		lt->end = getbe32(bin + pos + 4);
		lt->len = getbe32(bin + pos + 8);
		lt->data = bin + pos + 12;
		pos += 12 + lt->len;