--- a/mercurial/parsers.c Sat Feb 13 22:10:31 2010 +0100
+++ b/mercurial/parsers.c Sat Feb 13 17:37:44 2010 -0600
@@ -194,7 +194,7 @@
mtime = ntohl(*(uint32_t *)(decode + 8));
flen = ntohl(*(uint32_t *)(decode + 12));
cur += 17;
- if (flen > end - cur) {
+ if (cur + flen > end || cur + flen < cur) {
PyErr_SetString(PyExc_ValueError, "overflow in dirstate");
goto quit;
}
@@ -332,7 +332,7 @@
n++;
step = 64 + (inlined ? comp_len : 0);
- if (end - data < step)
+ if (data + step > end || data + step < data)
break;
data += step;
}