parsers: fix parse_dirstate to check len before unpacking header (issue4979) stable
authorYuya Nishihara <yuya@tcha.org>
Wed, 02 Dec 2015 23:04:58 +0900
branchstable
changeset 27226 f5e8cb813a4d
parent 27105 7e1fac6c0a9c
child 27227 f20533623833
parsers: fix parse_dirstate to check len before unpacking header (issue4979)
mercurial/parsers.c
--- a/mercurial/parsers.c	Tue Dec 01 20:18:28 2015 -0600
+++ b/mercurial/parsers.c	Wed Dec 02 23:04:58 2015 +0900
@@ -493,6 +493,11 @@
 
 	/* read filenames */
 	while (pos >= 40 && pos < len) {
+		if (pos + 17 > len) {
+			PyErr_SetString(PyExc_ValueError,
+					"overflow in dirstate");
+			goto quit;
+		}
 		cur = str + pos;
 		/* unpack header */
 		state = *cur;