Show More
@@ -157,6 +157,12 b' static const char *index_deref(indexObje' | |||
|
157 | 157 | return (const char *)(self->buf.buf) + pos * v1_hdrsize; |
|
158 | 158 | } |
|
159 | 159 | |
|
160 | /* | |
|
161 | * Get parents of the given rev. | |
|
162 | * | |
|
163 | * The specified rev must be valid and must not be nullrev. A returned | |
|
164 | * parent revision may be nullrev, but is guaranteed to be in valid range. | |
|
165 | */ | |
|
160 | 166 | static inline int index_get_parents(indexObject *self, Py_ssize_t rev, |
|
161 | 167 | int *ps, int maxrev) |
|
162 | 168 | { |
@@ -171,7 +177,7 b' static inline int index_get_parents(inde' | |||
|
171 | 177 | } |
|
172 | 178 | /* If index file is corrupted, ps[] may point to invalid revisions. So |
|
173 | 179 | * there is a risk of buffer overflow to trust them unconditionally. */ |
|
174 | if (ps[0] > maxrev || ps[1] > maxrev) { | |
|
180 | if (ps[0] < -1 || ps[0] > maxrev || ps[1] < -1 || ps[1] > maxrev) { | |
|
175 | 181 | PyErr_SetString(PyExc_ValueError, "parent out of range"); |
|
176 | 182 | return -1; |
|
177 | 183 | } |
@@ -133,12 +133,18 b' Test corrupted p1/p2 fields that could c' | |||
|
133 | 133 | $ cd invalidparent |
|
134 | 134 | |
|
135 | 135 | $ hg clone --pull -q --config phases.publish=False ../a limit |
|
136 | $ hg clone --pull -q --config phases.publish=False ../a neglimit | |
|
136 | 137 | $ hg clone --pull -q --config phases.publish=False ../a segv |
|
137 | $ rm -R limit/.hg/cache segv/.hg/cache | |
|
138 | $ rm -R limit/.hg/cache neglimit/.hg/cache segv/.hg/cache | |
|
138 | 139 | |
|
139 | 140 | $ "$PYTHON" <<EOF |
|
140 | 141 | > data = open("limit/.hg/store/00changelog.i", "rb").read() |
|
141 | > for n, p in [(b'limit', b'\0\0\0\x02'), (b'segv', b'\0\x01\0\0')]: | |
|
142 | > poisons = [ | |
|
143 | > (b'limit', b'\0\0\0\x02'), | |
|
144 | > (b'neglimit', b'\xff\xff\xff\xfe'), | |
|
145 | > (b'segv', b'\0\x01\0\0'), | |
|
146 | > ] | |
|
147 | > for n, p in poisons: | |
|
142 | 148 | > # corrupt p1 at rev0 and p2 at rev1 |
|
143 | 149 | > d = data[:24] + p + data[28:127 + 28] + p + data[127 + 32:] |
|
144 | 150 | > open(n + b"/.hg/store/00changelog.i", "wb").write(d) |
@@ -154,6 +160,11 b' Test corrupted p1/p2 fields that could c' | |||
|
154 | 160 | 0 1 1 -1 base 63 62 63 1.01613 63 0 0.00000 |
|
155 | 161 | 1 2 1 -1 base 66 65 66 1.01538 66 0 0.00000 |
|
156 | 162 | |
|
163 | $ hg -R neglimit debugrevlogindex -f1 -c | |
|
164 | rev flag size link p1 p2 nodeid | |
|
165 | 0 0000 62 0 -2 -1 7c31755bf9b5 | |
|
166 | 1 0000 65 1 0 -2 26333235a41c | |
|
167 | ||
|
157 | 168 |
$ |
|
158 | 169 | rev flag size link p1 p2 nodeid |
|
159 | 170 | 0 0000 62 0 65536 -1 7c31755bf9b5 |
@@ -193,6 +204,12 b' Test corrupted p1/p2 fields that could c' | |||
|
193 | 204 | index_headrevs: parent out of range |
|
194 | 205 | find_gca_candidates: parent out of range |
|
195 | 206 | find_deepest: parent out of range |
|
207 | $ "$PYTHON" test.py neglimit/.hg/store | |
|
208 | reachableroots: parent out of range | |
|
209 | compute_phases_map_sets: parent out of range | |
|
210 | index_headrevs: parent out of range | |
|
211 | find_gca_candidates: parent out of range | |
|
212 | find_deepest: parent out of range | |
|
196 | 213 | $ "$PYTHON" test.py segv/.hg/store |
|
197 | 214 | reachableroots: parent out of range |
|
198 | 215 | compute_phases_map_sets: parent out of range |
General Comments 0
You need to be logged in to leave comments.
Login now