From 37543541257c1066f8222e5c62933266936efabf Mon Sep 17 00:00:00 2001 From: Pavel Roskin Date: Wed, 5 Apr 2006 19:02:50 -0400 Subject: [PATCH 1/4] [PATCH] gitk: Fix searching for filenames in gitk findcont should not accept any arguments. Signed-off-by: Pavel Roskin Signed-off-by: Paul Mackerras --- gitk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitk b/gitk index 26fa79af7a..e1848cd528 100755 --- a/gitk +++ b/gitk @@ -2230,7 +2230,7 @@ proc donefilediff {} { } } -proc findcont {id} { +proc findcont {} { global findid treediffs parentlist global ffileline findstartline finddidsel global displayorder numcommits matchinglines findinprogress From c5a4c4debec43ff98053cb6b69d35d63e45ee131 Mon Sep 17 00:00:00 2001 From: Paul Mackerras Date: Thu, 6 Apr 2006 10:20:03 +1000 Subject: [PATCH 2/4] gitk: Fix incorrect invocation of getmergediffline Signed-off-by: Paul Mackerras --- gitk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitk b/gitk index e1848cd528..f88c06e565 100755 --- a/gitk +++ b/gitk @@ -2700,7 +2700,7 @@ proc getmergediffline {mdf id np} { incr nextupdate 100 fileevent $mdf readable {} update - fileevent $mdf readable [list getmergediffline $mdf $id] + fileevent $mdf readable [list getmergediffline $mdf $id $np] } } From 8960844a7890b1ac6ad5f8abf58a2a20923dde6d Mon Sep 17 00:00:00 2001 From: Nicolas Pitre Date: Fri, 7 Apr 2006 15:26:10 -0400 Subject: [PATCH 3/4] check patch_delta bounds more carefully Let's avoid going south with invalid delta data. Signed-off-by: Nicolas Pitre Signed-off-by: Junio C Hamano --- delta.h | 5 +++-- patch-delta.c | 26 +++++++++++++++++++++----- sha1_file.c | 6 ++++-- 3 files changed, 28 insertions(+), 9 deletions(-) diff --git a/delta.h b/delta.h index a15350dabc..9464f3e9b0 100644 --- a/delta.h +++ b/delta.h @@ -16,7 +16,8 @@ extern void *patch_delta(void *src_buf, unsigned long src_size, * This must be called twice on the delta data buffer, first to get the * expected reference buffer size, and again to get the result buffer size. */ -static inline unsigned long get_delta_hdr_size(const unsigned char **datap) +static inline unsigned long get_delta_hdr_size(const unsigned char **datap, + const unsigned char *top) { const unsigned char *data = *datap; unsigned char cmd; @@ -26,7 +27,7 @@ static inline unsigned long get_delta_hdr_size(const unsigned char **datap) cmd = *data++; size |= (cmd & ~0x80) << i; i += 7; - } while (cmd & 0x80); + } while (cmd & 0x80 && data < top); *datap = data; return size; } diff --git a/patch-delta.c b/patch-delta.c index c0e1311435..d95f0d9721 100644 --- a/patch-delta.c +++ b/patch-delta.c @@ -28,12 +28,12 @@ void *patch_delta(void *src_buf, unsigned long src_size, top = delta_buf + delta_size; /* make sure the orig file size matches what we expect */ - size = get_delta_hdr_size(&data); + size = get_delta_hdr_size(&data, top); if (size != src_size) return NULL; /* now the result size */ - size = get_delta_hdr_size(&data); + size = get_delta_hdr_size(&data, top); dst_buf = malloc(size + 1); if (!dst_buf) return NULL; @@ -52,21 +52,37 @@ void *patch_delta(void *src_buf, unsigned long src_size, if (cmd & 0x20) cp_size |= (*data++ << 8); if (cmd & 0x40) cp_size |= (*data++ << 16); if (cp_size == 0) cp_size = 0x10000; + if (cp_off + cp_size < cp_size || + cp_off + cp_size > src_size || + cp_size > size) + goto bad; memcpy(out, src_buf + cp_off, cp_size); out += cp_size; - } else { + size -= cp_size; + } else if (cmd) { + if (cmd > size) + goto bad; memcpy(out, data, cmd); out += cmd; data += cmd; + size -= cmd; + } else { + /* + * cmd == 0 is reserved for future encoding + * extensions. In the mean time we must fail when + * encountering them (might be data corruption). + */ + goto bad; } } /* sanity check */ - if (data != top || out - dst_buf != size) { + if (data != top || size != 0) { + bad: free(dst_buf); return NULL; } - *dst_size = size; + *dst_size = out - dst_buf; return dst_buf; } diff --git a/sha1_file.c b/sha1_file.c index aa09b4646a..d8ef565561 100644 --- a/sha1_file.c +++ b/sha1_file.c @@ -804,10 +804,12 @@ static int packed_delta_info(unsigned char *base_sha1, * the result size. */ data = delta_head; - get_delta_hdr_size(&data); /* ignore base size */ + + /* ignore base size */ + get_delta_hdr_size(&data, delta_head+sizeof(delta_head)); /* Read the result size */ - result_size = get_delta_hdr_size(&data); + result_size = get_delta_hdr_size(&data, delta_head+sizeof(delta_head)); *sizep = result_size; } return 0; From 98cf8156078eb5256d77d01786863185a1728140 Mon Sep 17 00:00:00 2001 From: Junio C Hamano Date: Fri, 7 Apr 2006 16:48:09 -0700 Subject: [PATCH 4/4] count-delta: match get_delta_hdr_size() changes. Signed-off-by: Junio C Hamano --- count-delta.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/count-delta.c b/count-delta.c index 058a2aadb1..54215df7f3 100644 --- a/count-delta.c +++ b/count-delta.c @@ -32,8 +32,8 @@ int count_delta(void *delta_buf, unsigned long delta_size, data = delta_buf; top = delta_buf + delta_size; - src_size = get_delta_hdr_size(&data); - dst_size = get_delta_hdr_size(&data); + src_size = get_delta_hdr_size(&data, top); + dst_size = get_delta_hdr_size(&data, top); added_literal = copied_from_source = out = 0; while (data < top) {