dirs: fix out-of-bounds access in Py3
The hack for mutating Python's variable-length integers that was
ported to py3 in
cb3048746dae (dirs: port PyInt code to work on Python
3, 2016-10-08) was reading from ob_digit[1] instead of ob_digit[0] for
some reason. Space for ob_digit[1] would only be allocated for
integers larger than 30 bits, so we ended up writing to unallocated
memory. Also, we would write an integer that's 2^30 times too large,
so we would never free these integers.
Found by AddressSanitizer.
Differential Revision: https://phab.mercurial-scm.org/D7597
$ cat > unix2mac.py <<EOF
> import sys
>
> for path in sys.argv[1:]:
> data = open(path, 'rb').read()
> data = data.replace(b'\n', b'\r')
> open(path, 'wb').write(data)
> EOF
$ cat > print.py <<EOF
> import sys
> print(sys.stdin.read().replace('\n', '<LF>').replace('\r', '<CR>').replace('\0', '<NUL>'))
> EOF
$ hg init
$ echo '[hooks]' >> .hg/hgrc
$ echo 'pretxncommit.cr = python:hgext.win32text.forbidcr' >> .hg/hgrc
$ echo 'pretxnchangegroup.cr = python:hgext.win32text.forbidcr' >> .hg/hgrc
$ cat .hg/hgrc
[hooks]
pretxncommit.cr = python:hgext.win32text.forbidcr
pretxnchangegroup.cr = python:hgext.win32text.forbidcr
$ echo hello > f
$ hg add f
$ hg ci -m 1
$ "$PYTHON" unix2mac.py f
$ hg ci -m 2
attempt to commit or push text file(s) using CR line endings
in dea860dc51ec: f
transaction abort!
rollback completed
abort: pretxncommit.cr hook failed
[255]
$ hg cat f | "$PYTHON" print.py
hello<LF>
$ cat f | "$PYTHON" print.py
hello<CR>