Mercurial > hg
comparison mercurial/cext/revlog.c @ 40741:959130631de3
revlog: properly detect corrupted revlog in `index_get_length`
Pointed out by Yuya Nishihara.
author | Boris Feld <boris.feld@octobus.net> |
---|---|
date | Mon, 26 Nov 2018 00:21:09 +0100 |
parents | cc76ca9fca20 |
children | 8edca70dc951 |
comparison
equal
deleted
inserted
replaced
40740:30d878cb102d | 40741:959130631de3 |
---|---|
240 return -1; | 240 return -1; |
241 } | 241 } |
242 return (int)ret; | 242 return (int)ret; |
243 } else { | 243 } else { |
244 const char *data = index_deref(self, rev); | 244 const char *data = index_deref(self, rev); |
245 return (int)getbe32(data + 8); | 245 int tmp = (int)getbe32(data + 8); |
246 if (tmp < 0) { | |
247 PyErr_Format(PyExc_OverflowError, | |
248 "revlog entry size out of bound (%d)", | |
249 tmp); | |
250 return -1; | |
251 } | |
252 return tmp; | |
246 } | 253 } |
247 } | 254 } |
248 | 255 |
249 /* | 256 /* |
250 * RevlogNG format (all in big endian, data may be inlined): | 257 * RevlogNG format (all in big endian, data may be inlined): |