vcs-svn: avoid hangs from corrupt deltas

diff --git a/vcs-svn/fast_export.c b/vcs-svn/fast_export.c
index 96a75d51d16c75d562758f62be2ca31e6eaf0f39..97f5fdf48985d408a4944ad678fb04a5ad9c6157 100644 (file)
--- a/vcs-svn/fast_export.c
+++ b/vcs-svn/fast_export.c
@@ -198,8 +198,7 @@ static long apply_delta(off_t len, struct line_buffer *input,
                        const char *old_data, uint32_t old_mode)
 {
        long ret;
-       off_t preimage_len = 0;
-       struct sliding_view preimage = SLIDING_VIEW_INIT(&report_buffer, -1);
+       struct sliding_view preimage = SLIDING_VIEW_INIT(&report_buffer, 0);
        FILE *out;
 
        if (init_postimage() || !(out = buffer_tmpfile_rewind(&postimage)))
@@ -211,19 +210,23 @@ static long apply_delta(off_t len, struct line_buffer *input,
                printf("cat-blob %s\n", old_data);
                fflush(stdout);
                response = get_response_line();
-               if (parse_cat_response_line(response, &preimage_len))
+               if (parse_cat_response_line(response, &preimage.max_off))
                        die("invalid cat-blob response: %s", response);
+               check_preimage_overflow(preimage.max_off, 1);
        }
        if (old_mode == REPO_MODE_LNK) {
                strbuf_addstr(&preimage.buf, "link ");
-               check_preimage_overflow(preimage_len, strlen("link "));
-               preimage_len += strlen("link ");
+               check_preimage_overflow(preimage.max_off, strlen("link "));
+               preimage.max_off += strlen("link ");
+               check_preimage_overflow(preimage.max_off, 1);
        }
        if (svndiff0_apply(input, len, &preimage, out))
                die("cannot apply delta");
        if (old_data) {
                /* Read the remainder of preimage and trailing newline. */
-               if (move_window(&preimage, preimage_len, 1))
+               assert(!signed_add_overflows(preimage.max_off, 1));
+               preimage.max_off++;     /* room for newline */
+               if (move_window(&preimage, preimage.max_off - 1, 1))
                        die("cannot seek to end of input");
                if (preimage.buf.buf[0] != '\n')
                        die("missing newline after cat-blob response");