This is an archive of the discontinued Mercurial Phabricator instance.

Differential D5464

parsers: better bounds checking in fm1readmarkers
ClosedPublic

Authored by durin42 on Dec 20 2018, 1:41 AM.

Details

Reviewers
None
Group Reviewers
hg-reviewers
Commits
rHG5c68b617ba24: parsers: better bounds checking in fm1readmarkers
Summary

Our Python already calls this with reasonable values consistently, but
my upcoming fuzzer is extremely quick to discover the lack of sanity
checking here.

Diff Detail

Repository
rHG Mercurial
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

durin42 created this revision.Dec 20 2018, 1:41 AM
Closed by commit rHG5c68b617ba24: parsers: better bounds checking in fm1readmarkers (authored by durin42). · Explain WhyDec 20 2018, 7:34 AM
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathPackages
Mmercurial/cext/parsers.c (11 lines)

Diff 12925

mercurial/cext/parsers.c

int datalen; int datalen;
Py_ssize_t offset, stop; Py_ssize_t offset, stop;
PyObject *markers = NULL; PyObject *markers = NULL;
if (!PyArg_ParseTuple(args, PY23("s#nn", "y#nn"), &data, &datalen, if (!PyArg_ParseTuple(args, PY23("s#nn", "y#nn"), &data, &datalen,
&offset, &stop)) { &offset, &stop)) {
return NULL; return NULL;
} }
if (offset < 0) {
PyErr_SetString(PyExc_ValueError,
"invalid negative offset in fm1readmarkers");
return NULL;
}
if (stop > datalen) {
PyErr_SetString(
PyExc_ValueError,
"stop longer than data length in fm1readmarkers");
return NULL;
}
dataend = data + datalen; dataend = data + datalen;
data += offset; data += offset;
markers = PyList_New(0); markers = PyList_New(0);
if (!markers) { if (!markers) {
return NULL; return NULL;
} }
while (offset < stop) { while (offset < stop) {
uint32_t msize; uint32_t msize;