This is an archive of the discontinued Mercurial Phabricator instance.

Differential D7234

dirs: reject consecutive slashes in paths
ClosedPublic

Authored by durin42 on Nov 5 2019, 6:41 PM.

Details

Reviewers
indygreg
Group Reviewers
hg-reviewers
Commits
rHG88562eb65232: dirs: reject consecutive slashes in paths
Summary

We shouldn't ever see those, and the fuzzer go really excited that if
it gives us a 65k string with 55k slashes in it we use a lot of RAM.

This is a better fix than what I tried in D7105. It was suggested by
Yuya, and I verified it does in fact cause the fuzzer to not OOM.

Diff Detail

Repository
rHG Mercurial
Lint
Lint Skipped
Unit
Unit Tests Skipped

Event Timeline

durin42 created this revision.Nov 5 2019, 6:41 PM
durin42 updated this revision to Diff 17564.Nov 5 2019, 6:46 PM
indygreg accepted this revision.Nov 5 2019, 10:26 PM
This revision is now accepted and ready to land.Nov 5 2019, 10:26 PM
durin42 added a commit: rHG88562eb65232: dirs: reject consecutive slashes in paths.Nov 5 2019, 10:36 PM
Closed by commit rHG88562eb65232: dirs: reject consecutive slashes in paths (authored by durin42). · Explain Why
This revision was automatically updated to reflect the committed changes.
indygreg added a comment.Nov 5 2019, 10:53 PM

I had to drop this from hg-committed because Python 3 was not amused:

SystemError: <method 'addpath' of 'parsers.dirs' objects> returned NULL without setting an error

PTAL @durin42

Revision Contents
Changeset List

PathPackages
Mmercurial/cext/dirs.c (5 lines)

Diff 17564

mercurial/cext/dirs.c

* implementation details. We also commit violations of the Python * implementation details. We also commit violations of the Python
* "protocol" such as mutating immutable objects. But since we only * "protocol" such as mutating immutable objects. But since we only
* mutate objects created in this function or in other well-defined * mutate objects created in this function or in other well-defined
* locations, the references are known so these violations should go * locations, the references are known so these violations should go
* unnoticed. */ * unnoticed. */
while ((pos = _finddir(cpath, pos - 1)) != -1) { while ((pos = _finddir(cpath, pos - 1)) != -1) {
PyObject *val; PyObject *val;
/* Sniff for trailing slashes, a marker of an invalid input. */
if (cpath[pos - 1] == '/') {
goto bail;
}
key = PyBytes_FromStringAndSize(cpath, pos); key = PyBytes_FromStringAndSize(cpath, pos);
if (key == NULL) if (key == NULL)
goto bail; goto bail;
val = PyDict_GetItem(dirs, key); val = PyDict_GetItem(dirs, key);
if (val != NULL) { if (val != NULL) {
PYLONG_VALUE(val) += 1; PYLONG_VALUE(val) += 1;
Py_CLEAR(key); Py_CLEAR(key);