git: 9front

Download patch

ref: 7fc7aa1b9321bf9a1ee225e85c0af08596709499
parent: b290b387859001a3fcc96aa899adba0c56e51cfe
author: cinap_lenrek <cinap_lenrek@felloff.net>
date: Sun Apr 3 00:04:56 EDT 2016 

mercurial: CVE-2016-3630

backported the following patches from mercurial 3.7.3:

https://selenic.com/repo/hg/rev/b6ed2505d6cf
https://selenic.com/repo/hg/rev/b9714d958e89


--- a/sys/lib/python/mercurial/mpatch.c
+++ b/sys/lib/python/mercurial/mpatch.c
@@ -239,7 +239,7 @@
 	char decode[12]; /* for dealing with alignment issues */
 
 	/* assume worst case size, we won't have many of these lists */
-	l = lalloc(len / 12);
+	l = lalloc(len / 12 + 1);
 	if (!l)
 		return NULL;
 
@@ -250,7 +250,7 @@
 		lt->start = ntohl(*(uint32_t *)decode);
 		lt->end = ntohl(*(uint32_t *)(decode + 4));
 		lt->len = ntohl(*(uint32_t *)(decode + 8));
-		if (lt->start > lt->end)
+		if (lt->start > lt->end || lt->len < 0)
 			break; /* sanity check */
 		bin = data + lt->len;
 		if (bin < data)
--- a/sys/src/cmd/hg/mercurial/mpatch.c
+++ b/sys/src/cmd/hg/mercurial/mpatch.c
@@ -239,7 +239,7 @@
 	char decode[12]; /* for dealing with alignment issues */
 
 	/* assume worst case size, we won't have many of these lists */
-	l = lalloc(len / 12);
+	l = lalloc(len / 12 + 1);
 	if (!l)
 		return NULL;
 
@@ -250,7 +250,7 @@
 		lt->start = ntohl(*(uint32_t *)decode);
 		lt->end = ntohl(*(uint32_t *)(decode + 4));
 		lt->len = ntohl(*(uint32_t *)(decode + 8));
-		if (lt->start > lt->end)
+		if (lt->start > lt->end || lt->len < 0)
 			break; /* sanity check */
 		bin = data + lt->len;
 		if (bin < data)
-- 
⑨