comparison mercurial/cext/revlog.c @ 40741:959130631de3

revlog: properly detect corrupted revlog in `index_get_length` Pointed out by Yuya Nishihara.
author Boris Feld <boris.feld@octobus.net>
date Mon, 26 Nov 2018 00:21:09 +0100
parents cc76ca9fca20
children 8edca70dc951
comparison
equal deleted inserted replaced
40740:30d878cb102d 40741:959130631de3
240 return -1; 240 return -1;
241 } 241 }
242 return (int)ret; 242 return (int)ret;
243 } else { 243 } else {
244 const char *data = index_deref(self, rev); 244 const char *data = index_deref(self, rev);
245 return (int)getbe32(data + 8); 245 int tmp = (int)getbe32(data + 8);
246 if (tmp < 0) {
247 PyErr_Format(PyExc_OverflowError,
248 "revlog entry size out of bound (%d)",
249 tmp);
250 return -1;
251 }
252 return tmp;
246 } 253 }
247 } 254 }
248 255
249 /* 256 /*
250 * RevlogNG format (all in big endian, data may be inlined): 257 * RevlogNG format (all in big endian, data may be inlined):