src/contrib/subversion/subversion/libsvn_delta/svndiff.c
/* Read a window header from STREAM and check it for integer overflow. */
Read a window header from STREAM and check it for integer overflow.
Read a window header from STREAM and check it for integer overflow .
static svn_error_t *
read_window_header(svn_stream_t *stream, svn_filesize_t *sview_offset,
                   apr_size_t *sview_len, apr_size_t *tview_len,
                   apr_size_t *inslen, apr_size_t *newlen,
                   apr_size_t *header_len)
{
  unsigned char c;
  *header_len = 0;
  *sview_offset = 0;
  while (1)
    {
      SVN_ERR(read_one_byte(&c, stream));
      ++*header_len;
      *sview_offset = (*sview_offset << 7) | (c & 0x7f);
      if (!(c & 0x80))
        break;
    }
  SVN_ERR(read_one_size(sview_len, header_len, stream));
  SVN_ERR(read_one_size(tview_len, header_len, stream));
  SVN_ERR(read_one_size(inslen, header_len, stream));
  SVN_ERR(read_one_size(newlen, header_len, stream));
  if (*tview_len > SVN_DELTA_WINDOW_SIZE ||
      *sview_len > SVN_DELTA_WINDOW_SIZE ||
      *newlen > SVN_DELTA_WINDOW_SIZE + SVN__MAX_ENCODED_UINT_LEN ||
      *inslen > MAX_INSTRUCTION_SECTION_LEN)
    return svn_error_create(SVN_ERR_SVNDIFF_CORRUPT_WINDOW, NULL,
                            _("Svndiff contains a too-large window"));
  if (*sview_offset < 0 || *inslen + *newlen < *inslen
      || *sview_len + *tview_len < *sview_len
      || (apr_size_t)*sview_offset + *sview_len < (apr_size_t)*sview_offset)
    return svn_error_create(SVN_ERR_SVNDIFF_CORRUPT_WINDOW, NULL,
                            _("Svndiff contains corrupt window header"));
  return SVN_NO_ERROR;
}
static svn_error_t * read_window_header ( svn_stream_t * stream , svn_filesize_t * sview_offset , apr_size_t * sview_len , apr_size_t * tview_len , apr_size_t * inslen , apr_size_t * newlen , apr_size_t * header_len ) { unsigned char c ; * header_len = 0 ; * sview_offset = 0 ; while ( 1 ) { SVN_ERR ( read_one_byte ( & c , stream ) ) ; ++ * header_len ; * sview_offset = ( * sview_offset << 7 ) | ( c & 0x7f ) ; if ( ! ( c & 0x80 ) ) break ; } SVN_ERR ( read_one_size ( sview_len , header_len , stream ) ) ; SVN_ERR ( read_one_size ( tview_len , header_len , stream ) ) ; SVN_ERR ( read_one_size ( inslen , header_len , stream ) ) ; SVN_ERR ( read_one_size ( newlen , header_len , stream ) ) ; if ( * tview_len > SVN_DELTA_WINDOW_SIZE || * sview_len > SVN_DELTA_WINDOW_SIZE || * newlen > SVN_DELTA_WINDOW_SIZE + SVN__MAX_ENCODED_UINT_LEN || * inslen > MAX_INSTRUCTION_SECTION_LEN ) return svn_error_create ( SVN_ERR_SVNDIFF_CORRUPT_WINDOW , NULL , _ ( " " ) ) ; if ( * sview_offset < 0 || * inslen + * newlen < * inslen || * sview_len + * tview_len < * sview_len || ( apr_size_t ) * sview_offset + * sview_len < ( apr_size_t ) * sview_offset ) return svn_error_create ( SVN_ERR_SVNDIFF_CORRUPT_WINDOW , NULL , _ ( " " ) ) ; return SVN_NO_ERROR ; }
Read a window header from STREAM and check it for integer overflow.
Read a window header from STREAM and check it for integer overflow .
/* Read the source view offset by hand, since it's not an apr_size_t. */ /* Read the four size fields. */ /* for svndiff1, newlen includes the original length */ /* Check for integer overflow.  */