This is an archive of the discontinued Mercurial Phabricator instance.

Differential D1904

bdiff: Handle the possibility of integer overflow when computing allocation size
ClosedPublic

Authored by alex_gaynor on Jan 18 2018, 9:43 AM.

Details

Reviewers
durin42
Group Reviewers
hg-reviewers
Commits
rHG50868145a8de: bdiff: handle the possibility of overflow when computing allocation size
rHGee3cadb495e6: bdiff: Handle the possibility of integer overflow when computing allocation size

Diff Detail

Repository
rHG Mercurial
Branch
malloc-overflow (bookmark) on default (branch)
Lint
No Linters Available
Unit
No Unit Test Coverage

Event Timeline

alex_gaynor created this revision.Jan 18 2018, 9:43 AM
durin42 accepted this revision.Jan 18 2018, 2:38 PM
This revision is now accepted and ready to land.Jan 18 2018, 2:38 PM
Closed by commit rHGee3cadb495e6: bdiff: Handle the possibility of integer overflow when computing allocation size (authored by alex_gaynor). · Explain WhyJan 18 2018, 2:58 PM
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathPackages
Mmercurial/bdiff.c (2 lines)

Diff 4904

mercurial/bdiff.c

struct pos *h = NULL; struct pos *h = NULL;
/* build a hash table of the next highest power of 2 */ /* build a hash table of the next highest power of 2 */
while (buckets < bn + 1) while (buckets < bn + 1)
buckets *= 2; buckets *= 2;
/* try to allocate a large hash table to avoid collisions */ /* try to allocate a large hash table to avoid collisions */
for (scale = 4; scale; scale /= 2) { for (scale = 4; scale; scale /= 2) {
h = (struct pos *)malloc(scale * buckets * sizeof(struct pos)); h = (struct pos *)calloc(buckets, scale * sizeof(struct pos));
if (h) if (h)
break; break;
} }
if (!h) if (!h)
return 0; return 0;
buckets = buckets * scale - 1; buckets = buckets * scale - 1;