vcs-svn: cap number of bytes read from sliding view

Introduce a "max_off" field in struct sliding_view, roughly
representing a maximum number of bytes that can be read from "file".
If it is set to a nonnegative integer, a call to move_window()
attempting to put the right endpoint beyond that offset will return
an error instead.

The idea is to use this when applying Subversion-format deltas to
prevent reads past the end of the preimage (which has known length).
Without such a check, corrupt deltas would cause svn-fe to block
indefinitely when data in the input pipe is exhausted.

Inspired-by: Ramkumar Ramachandra <artagnon@gmail.com>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>

diff --git a/test-svn-fe.c b/test-svn-fe.c
index a0276260eb15f9f7bb7fbafb4447a1cc7c84718d..332a5f711df8f3e3fea3305eb5ecb10de5581033 100644 (file)
--- a/test-svn-fe.c
+++ b/test-svn-fe.c
@@ -15,7 +15,7 @@ static int apply_delta(int argc, char *argv[])
 {
        struct line_buffer preimage = LINE_BUFFER_INIT;
        struct line_buffer delta = LINE_BUFFER_INIT;
 {
        struct line_buffer preimage = LINE_BUFFER_INIT;
        struct line_buffer delta = LINE_BUFFER_INIT;

-       struct sliding_view preimage_view = SLIDING_VIEW_INIT(&preimage);
+       struct sliding_view preimage_view = SLIDING_VIEW_INIT(&preimage, -1);

 
        if (argc != 5)
                usage(test_svnfe_usage);
 
        if (argc != 5)
                usage(test_svnfe_usage);

diff --git a/vcs-svn/sliding_window.c b/vcs-svn/sliding_window.c
index 1b8d9875ed8831a98d0107db71e0ba1c3083a714..1bac7a4c7f0df0ccee7755d9d441ebb26d96c323 100644 (file)
--- a/vcs-svn/sliding_window.c
+++ b/vcs-svn/sliding_window.c
@@ -54,6 +54,8 @@ int move_window(struct sliding_view *view, off_t off, size_t width)
                return -1;
        if (off < view->off || off + width < view->off + view->width)
                return error("invalid delta: window slides left");
                return -1;
        if (off < view->off || off + width < view->off + view->width)
                return error("invalid delta: window slides left");

+       if (view->max_off >= 0 && view->max_off < off + width)
+               return error("delta preimage ends early");

 
        file_offset = view->off + view->buf.len;
        if (off < file_offset) {
 
        file_offset = view->off + view->buf.len;
        if (off < file_offset) {

diff --git a/vcs-svn/sliding_window.h b/vcs-svn/sliding_window.h
index ed0bfdd65c0c7285eebdfd5c163f769db7bb66e2..b43a825cbabe92b8b9da7d1ff2856763fe26fc29 100644 (file)
--- a/vcs-svn/sliding_window.h
+++ b/vcs-svn/sliding_window.h
@@ -7,10 +7,11 @@ struct sliding_view {
        struct line_buffer *file;
        off_t off;
        size_t width;
        struct line_buffer *file;
        off_t off;
        size_t width;

+       off_t max_off;  /* -1 means unlimited */

        struct strbuf buf;
 };
 
        struct strbuf buf;
 };
 

-#define SLIDING_VIEW_INIT(input)       { (input), 0, 0, STRBUF_INIT }
+#define SLIDING_VIEW_INIT(input, len)  { (input), 0, 0, (len), STRBUF_INIT }

 
 extern int move_window(struct sliding_view *view, off_t off, size_t width);
 
 
 extern int move_window(struct sliding_view *view, off_t off, size_t width);