Patchwork [1,of,2] dirstate: fix parse_dirstate() to error out if NULL entry created

login
register
mail settings
Submitter Yuya Nishihara
Date Sept. 23, 2021, 8:27 a.m.
Message ID <13efd8fdc55fe3ed8ab1.1632385653@lemosa>
Download mbox | patch
Permalink /patch/49808/
State New
Headers show

Comments

Yuya Nishihara - Sept. 23, 2021, 8:27 a.m.
# HG changeset patch
# User Yuya Nishihara <yuya@tcha.org>
# Date 1632383057 -32400
#      Thu Sep 23 16:44:17 2021 +0900
# Node ID 13efd8fdc55fe3ed8ab195fff0c52a249d4dcc73
# Parent  1b2ee68e85f93c0726db9f2f739bc6768db1f92f
dirstate: fix parse_dirstate() to error out if NULL entry created

Since 83f0e93ec34b "dirstate-item: move the C implementation to the same
logic", dirstate_item_from_v1_data() gets more likely to return NULL, and
the fuzzer crashes because of that.
Raphaël Gomès - Sept. 23, 2021, 8:51 a.m.
Queued both patches, thanks!

On 9/23/21 10:27 AM, Yuya Nishihara wrote:
> # HG changeset patch
> # User Yuya Nishihara <yuya@tcha.org>
> # Date 1632383057 -32400
> #      Thu Sep 23 16:44:17 2021 +0900
> # Node ID 13efd8fdc55fe3ed8ab195fff0c52a249d4dcc73
> # Parent  1b2ee68e85f93c0726db9f2f739bc6768db1f92f
> dirstate: fix parse_dirstate() to error out if NULL entry created
>
> Since 83f0e93ec34b "dirstate-item: move the C implementation to the same
> logic", dirstate_item_from_v1_data() gets more likely to return NULL, and
> the fuzzer crashes because of that.
>
> diff --git a/mercurial/cext/parsers.c b/mercurial/cext/parsers.c
> --- a/mercurial/cext/parsers.c
> +++ b/mercurial/cext/parsers.c
> @@ -770,6 +770,8 @@ static PyObject *parse_dirstate(PyObject
>   
>   		entry = (PyObject *)dirstate_item_from_v1_data(state, mode,
>   		                                               size, mtime);
> +		if (!entry)
> +			goto quit;
>   		cpos = memchr(cur, 0, flen);
>   		if (cpos) {
>   			fname = PyBytes_FromStringAndSize(cur, cpos - cur);
>
> _______________________________________________
> Mercurial-devel mailing list
> Mercurial-devel@mercurial-scm.org
> https://www.mercurial-scm.org/mailman/listinfo/mercurial-devel

Patch

diff --git a/mercurial/cext/parsers.c b/mercurial/cext/parsers.c
--- a/mercurial/cext/parsers.c
+++ b/mercurial/cext/parsers.c
@@ -770,6 +770,8 @@  static PyObject *parse_dirstate(PyObject
 
 		entry = (PyObject *)dirstate_item_from_v1_data(state, mode,
 		                                               size, mtime);
+		if (!entry)
+			goto quit;
 		cpos = memchr(cur, 0, flen);
 		if (cpos) {
 			fname = PyBytes_FromStringAndSize(cur, cpos - cur);