comparison mercurial/cext/revlog.c @ 41018:f4113489e4d4 stable

revlog: catch revlog corruption in index_baserev

A revision cannot use a base above itself, it can only happens one corrupted
repository.

Ignoring such corrupted could lead to infinite loop.

41017:d7d3164e6a31

 * Callers must ensure that rev >= 0 or illegal memory access may occur.
 */
static inline int index_baserev(indexObject *self, int rev)
{
	const char *data;

	if (rev >= self->length) {
		PyObject *tuple = PyList_GET_ITEM(self->added, rev - self->length);
		return (int)PyInt_AS_LONG(PyTuple_GET_ITEM(tuple, 3));
	}
	else {
		data = index_deref(self, rev);
		if (data == NULL) {
			return -2;
		}

		return getbe32(data + 16);
	}
}

static PyObject *index_deltachain(indexObject *self, PyObject *args)
{
	int rev, generaldelta;

41018:f4113489e4d4

 * Callers must ensure that rev >= 0 or illegal memory access may occur.
 */
static inline int index_baserev(indexObject *self, int rev)
{
	const char *data;
	int result;

	if (rev >= self->length) {
		PyObject *tuple = PyList_GET_ITEM(self->added, rev - self->length);
		result = (int)PyInt_AS_LONG(PyTuple_GET_ITEM(tuple, 3));
	}
	else {
		data = index_deref(self, rev);
		if (data == NULL) {
			return -2;
		}

		result = getbe32(data + 16);
	}
	if (result > rev) {
		PyErr_Format(
		    PyExc_ValueError,
		    "corrupted revlog, revision base above revision: %d, %d",
		    rev, result);
		return -2;
	}
	return result;
}

static PyObject *index_deltachain(indexObject *self, PyObject *args)
{
	int rev, generaldelta;