Show More
@@ -202,7 +202,7 b' static struct flist *decode(const char *' | |||
|
202 | 202 | { |
|
203 | 203 | struct flist *l; |
|
204 | 204 | struct frag *lt; |
|
205 | const char *data = bin + 12, *end = bin + len; | |
|
205 | int pos = 0; | |
|
206 | 206 | |
|
207 | 207 | /* assume worst case size, we won't have many of these lists */ |
|
208 | 208 | l = lalloc(len / 12); |
@@ -211,21 +211,18 b' static struct flist *decode(const char *' | |||
|
211 | 211 | |
|
212 | 212 | lt = l->tail; |
|
213 | 213 | |
|
214 | while (data <= end) { | |
|
215 | lt->start = getbe32(bin); | |
|
216 | lt->end = getbe32(bin + 4); | |
|
217 | lt->len = getbe32(bin + 8); | |
|
214 | while (pos >= 0 && pos < len) { | |
|
215 | lt->start = getbe32(bin + pos); | |
|
216 | lt->end = getbe32(bin + pos + 4); | |
|
217 | lt->len = getbe32(bin + pos + 8); | |
|
218 | 218 | if (lt->start > lt->end) |
|
219 | 219 | break; /* sanity check */ |
|
220 | bin = data + lt->len; | |
|
221 | if (bin < data) | |
|
222 | break; /* big data + big (bogus) len can wrap around */ | |
|
223 | lt->data = data; | |
|
224 | data = bin + 12; | |
|
220 | lt->data = bin + pos + 12; | |
|
221 | pos += 12 + lt->len; | |
|
225 | 222 | lt++; |
|
226 | 223 | } |
|
227 | 224 | |
|
228 |
if ( |
|
|
225 | if (pos != len) { | |
|
229 | 226 | if (!PyErr_Occurred()) |
|
230 | 227 | PyErr_SetString(mpatch_Error, "patch cannot be decoded"); |
|
231 | 228 | lfree(l); |
@@ -355,32 +352,26 b' cleanup:' | |||
|
355 | 352 | static PyObject * |
|
356 | 353 | patchedsize(PyObject *self, PyObject *args) |
|
357 | 354 | { |
|
358 | long orig, start, end, len, outlen = 0, last = 0; | |
|
355 | long orig, start, end, len, outlen = 0, last = 0, pos = 0; | |
|
359 | 356 | Py_ssize_t patchlen; |
|
360 | char *bin, *binend, *data; | |
|
357 | char *bin; | |
|
361 | 358 | |
|
362 | 359 | if (!PyArg_ParseTuple(args, "ls#", &orig, &bin, &patchlen)) |
|
363 | 360 | return NULL; |
|
364 | 361 | |
|
365 | binend = bin + patchlen; | |
|
366 | data = bin + 12; | |
|
367 | ||
|
368 | while (data <= binend) { | |
|
369 | start = getbe32(bin); | |
|
370 | end = getbe32(bin + 4); | |
|
371 | len = getbe32(bin + 8); | |
|
362 | while (pos >= 0 && pos < patchlen) { | |
|
363 | start = getbe32(bin + pos); | |
|
364 | end = getbe32(bin + pos + 4); | |
|
365 | len = getbe32(bin + pos + 8); | |
|
372 | 366 | if (start > end) |
|
373 | 367 | break; /* sanity check */ |
|
374 |
|
|
|
375 | if (bin < data) | |
|
376 | break; /* big data + big (bogus) len can wrap around */ | |
|
377 | data = bin + 12; | |
|
368 | pos += 12 + len; | |
|
378 | 369 | outlen += start - last; |
|
379 | 370 | last = end; |
|
380 | 371 | outlen += len; |
|
381 | 372 | } |
|
382 | 373 | |
|
383 |
if ( |
|
|
374 | if (pos != patchlen) { | |
|
384 | 375 | if (!PyErr_Occurred()) |
|
385 | 376 | PyErr_SetString(mpatch_Error, "patch cannot be decoded"); |
|
386 | 377 | return NULL; |
@@ -155,10 +155,10 b' static PyObject *parse_dirstate(PyObject' | |||
|
155 | 155 | { |
|
156 | 156 | PyObject *dmap, *cmap, *parents = NULL, *ret = NULL; |
|
157 | 157 | PyObject *fname = NULL, *cname = NULL, *entry = NULL; |
|
158 |
char state, * |
|
|
158 | char state, *cur, *str, *cpos; | |
|
159 | 159 | int mode, size, mtime; |
|
160 | 160 | unsigned int flen; |
|
161 | int len; | |
|
161 | int len, pos = 40; | |
|
162 | 162 | |
|
163 | 163 | if (!PyArg_ParseTuple(args, "O!O!s#:parse_dirstate", |
|
164 | 164 | &PyDict_Type, &dmap, |
@@ -175,18 +175,17 b' static PyObject *parse_dirstate(PyObject' | |||
|
175 | 175 | goto quit; |
|
176 | 176 | |
|
177 | 177 | /* read filenames */ |
|
178 | cur = str + 40; | |
|
179 |
|
|
|
180 | ||
|
181 | while (cur < end - 17) { | |
|
178 | while (pos >= 40 && pos < len) { | |
|
179 | cur = str + pos; | |
|
182 | 180 | /* unpack header */ |
|
183 | 181 | state = *cur; |
|
184 | 182 | mode = getbe32(cur + 1); |
|
185 | 183 | size = getbe32(cur + 5); |
|
186 | 184 | mtime = getbe32(cur + 9); |
|
187 | 185 | flen = getbe32(cur + 13); |
|
186 | pos += 17; | |
|
188 | 187 | cur += 17; |
|
189 |
if ( |
|
|
188 | if (flen > len - pos || flen < 0) { | |
|
190 | 189 | PyErr_SetString(PyExc_ValueError, "overflow in dirstate"); |
|
191 | 190 | goto quit; |
|
192 | 191 | } |
@@ -212,10 +211,10 b' static PyObject *parse_dirstate(PyObject' | |||
|
212 | 211 | PyDict_SetItem(dmap, fname, entry) == -1) |
|
213 | 212 | goto quit; |
|
214 | 213 | } |
|
215 | cur += flen; | |
|
216 | 214 | Py_DECREF(fname); |
|
217 | 215 | Py_DECREF(entry); |
|
218 | 216 | fname = cname = entry = NULL; |
|
217 | pos += flen; | |
|
219 | 218 | } |
|
220 | 219 | |
|
221 | 220 | ret = parents; |
@@ -1678,28 +1677,23 b' static int index_assign_subscript(indexO' | |||
|
1678 | 1677 | static long inline_scan(indexObject *self, const char **offsets) |
|
1679 | 1678 | { |
|
1680 | 1679 | const char *data = PyString_AS_STRING(self->data); |
|
1681 | const char *end = data + PyString_GET_SIZE(self->data); | |
|
1680 | Py_ssize_t pos = 0; | |
|
1681 | Py_ssize_t end = PyString_GET_SIZE(self->data); | |
|
1682 | 1682 | long incr = v1_hdrsize; |
|
1683 | 1683 | Py_ssize_t len = 0; |
|
1684 | 1684 | |
|
1685 |
while ( |
|
|
1685 | while (pos + v1_hdrsize <= end && pos >= 0) { | |
|
1686 | 1686 | uint32_t comp_len; |
|
1687 | const char *old_data; | |
|
1688 | 1687 | /* 3rd element of header is length of compressed inline data */ |
|
1689 | comp_len = getbe32(data + 8); | |
|
1688 | comp_len = getbe32(data + pos + 8); | |
|
1690 | 1689 | incr = v1_hdrsize + comp_len; |
|
1691 | if (incr < v1_hdrsize) | |
|
1692 | break; | |
|
1693 | 1690 | if (offsets) |
|
1694 | offsets[len] = data; | |
|
1691 | offsets[len] = data + pos; | |
|
1695 | 1692 | len++; |
|
1696 | old_data = data; | |
|
1697 | data += incr; | |
|
1698 | if (data <= old_data) | |
|
1699 | break; | |
|
1693 | pos += incr; | |
|
1700 | 1694 | } |
|
1701 | 1695 | |
|
1702 | if (data != end && data + v1_hdrsize != end) { | |
|
1696 | if (pos != end) { | |
|
1703 | 1697 | if (!PyErr_Occurred()) |
|
1704 | 1698 | PyErr_SetString(PyExc_ValueError, "corrupt index file"); |
|
1705 | 1699 | return -1; |
General Comments 0
You need to be logged in to leave comments.
Login now