# HG changeset patch # User Yuya Nishihara # Date 1444556501 -32400 # Node ID 473a63c45394e7c6d88bd4e40721a7256599ca32 # Parent fb388aa26453080a703a22df8b199689295114ba parsers: read sizes of metadata pair of obsolete marker at once This will make it easy to implement bound checking. Currently fm1readmarker() has no protection for corrupted obsstore and can cause infinite loop or out-of-bound reads. diff -r fb388aa26453 -r 473a63c45394 mercurial/parsers.c --- a/mercurial/parsers.c Wed Oct 07 21:51:24 2015 -0700 +++ b/mercurial/parsers.c Sun Oct 11 18:41:41 2015 +0900 @@ -2630,12 +2630,12 @@ } for (i = 0; i < nmetadata; i++) { PyObject *tmp, *left = NULL, *right = NULL; - Py_ssize_t metasize = (unsigned char)(*data++); - left = PyString_FromStringAndSize(meta, metasize); - meta += metasize; - metasize = (unsigned char)(*data++); - right = PyString_FromStringAndSize(meta, metasize); - meta += metasize; + Py_ssize_t leftsize = (unsigned char)(*data++); + Py_ssize_t rightsize = (unsigned char)(*data++); + left = PyString_FromStringAndSize(meta, leftsize); + meta += leftsize; + right = PyString_FromStringAndSize(meta, rightsize); + meta += rightsize; tmp = PyTuple_New(2); if (!left || !right || !tmp) { Py_XDECREF(left);