# HG changeset patch
# User Augie Fackler <augie@google.com>
# Date 2018-05-01 02:23:06
# Node ID 59837a16896da36d26e795881f4ba4454cb8ae41
# Parent  7f22ef3c0ee721da8a568613dff48a7051fad8d7

mpatch: avoid integer overflow in mpatch_decode (SEC)

diff --git a/mercurial/mpatch.c b/mercurial/mpatch.c
--- a/mercurial/mpatch.c
+++ b/mercurial/mpatch.c
@@ -285,10 +285,15 @@ int mpatch_decode(const char *bin, ssize
 		lt->start = getbe32(bin + pos);
 		lt->end = getbe32(bin + pos + 4);
 		lt->len = getbe32(bin + pos + 8);
-		lt->data = bin + pos + 12;
-		pos += 12 + lt->len;
-		if (lt->start > lt->end || lt->len < 0)
+		if (lt->start < 0 || lt->start > lt->end || lt->len < 0)
 			break; /* sanity check */
+		if (!safeadd(12, &pos)) {
+			break;
+		}
+		lt->data = bin + pos;
+		if (!safeadd(lt->len, &pos)) {
+			break;
+		}
 		lt++;
 	}