comparison tests/test-parseindex.t @ 40812:9cdd525d97b2 stable

revlog: fix out-of-bounds access by negative parents read from revlog (SEC)

82d6a35cf432 wasn't enough. Several callers don't check negative revisions
but for -1 (nullrev), which would directly lead to out-of-bounds read, and
buffer overflow could follow. RCE might be doable with carefully crafted
revlog structure, though I don't think this would be useful attack surface.

40803:44c2e80db985

  $ mkdir invalidparent
  $ cd invalidparent

  $ hg clone --pull -q --config phases.publish=False ../a limit
  $ hg clone --pull -q --config phases.publish=False ../a segv
  $ rm -R limit/.hg/cache segv/.hg/cache

  $ "$PYTHON" <<EOF
  > data = open("limit/.hg/store/00changelog.i", "rb").read()
  > for n, p in [(b'limit', b'\0\0\0\x02'), (b'segv', b'\0\x01\0\0')]:
  >     # corrupt p1 at rev0 and p2 at rev1
  >     d = data[:24] + p + data[28:127 + 28] + p + data[127 + 32:]
  >     open(n + b"/.hg/store/00changelog.i", "wb").write(d)
  > EOF

  $ hg -R limit debugdeltachain -c
      rev  chain# chainlen     prev   delta       size    rawsize  chainsize     ratio   lindist extradist extraratio
        0       1        1       -1    base         63         62         63   1.01613        63         0    0.00000
        1       2        1       -1    base         66         65         66   1.01538        66         0    0.00000

  $ hg -R segv debugrevlogindex -f1 -c
     rev flag     size   link     p1     p2       nodeid
       0 0000       62      0  65536     -1 7c31755bf9b5
       1 0000       65      1      0  65536 26333235a41c

  reachableroots: parent out of range
  compute_phases_map_sets: parent out of range
  index_headrevs: parent out of range
  find_gca_candidates: parent out of range
  find_deepest: parent out of range
  $ "$PYTHON" test.py segv/.hg/store
  reachableroots: parent out of range
  compute_phases_map_sets: parent out of range
  index_headrevs: parent out of range
  find_gca_candidates: parent out of range

40812:9cdd525d97b2

  $ mkdir invalidparent
  $ cd invalidparent

  $ hg clone --pull -q --config phases.publish=False ../a limit
  $ hg clone --pull -q --config phases.publish=False ../a neglimit
  $ hg clone --pull -q --config phases.publish=False ../a segv
  $ rm -R limit/.hg/cache neglimit/.hg/cache segv/.hg/cache

  $ "$PYTHON" <<EOF
  > data = open("limit/.hg/store/00changelog.i", "rb").read()
  > poisons = [
  >     (b'limit', b'\0\0\0\x02'),
  >     (b'neglimit', b'\xff\xff\xff\xfe'),
  >     (b'segv', b'\0\x01\0\0'),
  > ]
  > for n, p in poisons:
  >     # corrupt p1 at rev0 and p2 at rev1
  >     d = data[:24] + p + data[28:127 + 28] + p + data[127 + 32:]
  >     open(n + b"/.hg/store/00changelog.i", "wb").write(d)
  > EOF

  $ hg -R limit debugdeltachain -c
      rev  chain# chainlen     prev   delta       size    rawsize  chainsize     ratio   lindist extradist extraratio
        0       1        1       -1    base         63         62         63   1.01613        63         0    0.00000
        1       2        1       -1    base         66         65         66   1.01538        66         0    0.00000

  $ hg -R neglimit debugrevlogindex -f1 -c
     rev flag     size   link     p1     p2       nodeid
       0 0000       62      0     -2     -1 7c31755bf9b5
       1 0000       65      1      0     -2 26333235a41c

  $ hg -R segv debugrevlogindex -f1 -c
     rev flag     size   link     p1     p2       nodeid
       0 0000       62      0  65536     -1 7c31755bf9b5
       1 0000       65      1      0  65536 26333235a41c

  reachableroots: parent out of range
  compute_phases_map_sets: parent out of range
  index_headrevs: parent out of range
  find_gca_candidates: parent out of range
  find_deepest: parent out of range
  $ "$PYTHON" test.py neglimit/.hg/store
  reachableroots: parent out of range
  compute_phases_map_sets: parent out of range
  index_headrevs: parent out of range
  find_gca_candidates: parent out of range
  find_deepest: parent out of range
  $ "$PYTHON" test.py segv/.hg/store
  reachableroots: parent out of range
  compute_phases_map_sets: parent out of range
  index_headrevs: parent out of range
  find_gca_candidates: parent out of range