Mercurial > hg
changeset 28656:b6ed2505d6cf stable
parsers: fix list sizing rounding error (SEC)
CVE-2016-3630 (1/2)
This addresses part of a vulnerability in application of binary
deltas.
| author | Matt Mackall <mpm@selenic.com> |
|---|---|
| date | Wed, 16 Mar 2016 17:29:29 -0700 |
| parents | a2c2dd399f3b |
| children | b9714d958e89 |
| files | mercurial/mpatch.c tests/test-revlog.t |
| diffstat | 2 files changed, 16 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/mercurial/mpatch.c Fri Mar 25 10:47:49 2016 -0700 +++ b/mercurial/mpatch.c Wed Mar 16 17:29:29 2016 -0700 @@ -205,7 +205,7 @@ int pos = 0; /* assume worst case size, we won't have many of these lists */ - l = lalloc(len / 12); + l = lalloc(len / 12 + 1); if (!l) return NULL;
--- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/tests/test-revlog.t Wed Mar 16 17:29:29 2016 -0700 @@ -0,0 +1,15 @@ +Test for CVE-2016-3630 + + $ hg init + + >>> open("a.i", "w").write( + ... """eJxjYGZgZIAAYQYGxhgom+k/FMx8YKx9ZUaKSOyqo4cnuKb8mbqHV5cBCVTMWb1Cwqkhe4Gsg9AD + ... Joa3dYtcYYYBAQ8Qr4OqZAYRICPTSr5WKd/42rV36d+8/VmrNpv7NP1jQAXrQE4BqQUARngwVA==""" + ... .decode("base64").decode("zlib")) + + $ hg debugindex a.i + rev offset length delta linkrev nodeid p1 p2 + 0 0 19 -1 2 99e0332bd498 000000000000 000000000000 + 1 19 12 0 3 6674f57a23d8 99e0332bd498 000000000000 + $ hg debugdata a.i 1 2>&1 | grep decoded + mpatch.mpatchError: patch cannot be decoded