File hg-mpatch-fix07.patch of Package mercurial

Overview Repositories Revisions Requests Users Attributes Meta

File hg-mpatch-fix07.patch of Package mercurial (Revision 183dc32bfdce770feb20771feab4f3eb)

Currently displaying revision 183dc32bfdce770feb20771feab4f3eb , Show latest

# HG changeset patch
# User Augie Fackler <augie@google.com>
# Date 1525141213 14400
# Node ID 7f22ef3c0ee721da8a568613dff48a7051fad8d7
# Parent  0b208c13781c18deae8fddb1dd63677f61fd64b5
mpatch: fix UB integer overflows in discard() (SEC)

---
 mercurial/mpatch.c |   32 ++++++++++++++++++++++++++++----
 1 file changed, 28 insertions(+), 4 deletions(-)

--- a/mercurial/mpatch.c
+++ b/mercurial/mpatch.c
@@ -186,16 +186,40 @@ static int discard(struct flist *src, in
 	int postend, c, l;
 
 	while (s != src->tail) {
-		if (s->start + offset >= cut)
+		int cmpcut = s->start;
+		if (!safeadd(offset, &cmpcut)) {
+			break;
+		}
+		if (cmpcut >= cut)
 			break;
 
-		postend = offset + s->start + s->len;
+		postend = offset;
+		if (!safeadd(s->start, &postend)) {
+			break;
+		}
+		if (!safeadd(s->len, &postend)) {
+			break;
+		}
 		if (postend <= cut) {
-			offset += s->start + s->len - s->end;
+			/* do the subtraction first to avoid UB integer overflow
+			 */
+			int tmp = s->start;
+			if (!safesub(s->end, &tmp)) {
+				break;
+			}
+			if (!safeadd(s->len, &tmp)) {
+				break;
+			}
+			if (!safeadd(tmp, &offset)) {
+				break;
+			}
 			s++;
 		}
 		else {
-			c = cut - offset;
+			c = cut;
+			if (!safesub(offset, &c)) {
+				break;
+			}
 			if (s->end < c)
 				c = s->end;
 			l = cut - offset - s->start;

Places

File hg-mpatch-fix07.patch of Package mercurial (Revision 183dc32bfdce770feb20771feab4f3eb)

Places