Attachment 20697 Details for Bug 54773

[patch] The same patch for the krahmer-esser issues but for 1.12

cvs-krahmer-esser-1.12.x.diff (text/plain), 8.33 KB, created by Sebastian Krahmer on 2004-06-04 16:25:31 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Sebastian Krahmer

Created: 2004-06-04 16:25:31 UTC

Size: 8.33 KB

patch

obsolete

>Index: src/commit.c
>===================================================================
>RCS file: /cvsroot/ccvs/src/commit.c,v
>retrieving revision 1.232
>diff -u -p -r1.232 commit.c
>--- src/commit.c	11 May 2004 17:33:52 -0000	1.232
>+++ src/commit.c	28 May 2004 15:48:45 -0000
>@@ -485,7 +485,12 @@ commit (int argc, char **argv)
> 	   operate on, and only work with those files in the future.
> 	   This saves time--we don't want to search the file system
> 	   of the working directory twice.  */
>-	find_args.argv = xmalloc (find_args.argc * sizeof (char **));
>+	if (size_overflow_p (xtimes (find_args.argc, sizeof (char **))))
>+	{
>+	    find_args.argc = 0;
>+	    return 0;
>+	}
>+	find_args.argv = xmalloc (xtimes (find_args.argc, sizeof (char **)));
> 	find_args.argc = 0;
> 	walklist (find_args.ulist, copy_ulist, &find_args);
> 
>Index: src/cvs.h
>===================================================================
>RCS file: /cvsroot/ccvs/src/cvs.h,v
>retrieving revision 1.295
>diff -u -p -r1.295 cvs.h
>--- src/cvs.h	20 May 2004 03:00:43 -0000	1.295
>+++ src/cvs.h	28 May 2004 15:45:05 -0000
>@@ -43,6 +43,7 @@
> #include "exit.h"
> #include "vasnprintf.h"
> #include "xalloc.h"
>+#include "xsize.h"
> /* end GNULIB headers */
> 
> #if ! STDC_HEADERS
>Index: src/filesubr.c
>===================================================================
>RCS file: /cvsroot/ccvs/src/filesubr.c,v
>retrieving revision 1.83
>diff -u -p -r1.83 filesubr.c
>--- src/filesubr.c	27 Apr 2004 20:47:37 -0000	1.83
>+++ src/filesubr.c	28 May 2004 18:37:52 -0000
>@@ -930,8 +930,14 @@ void
> expand_wild (int argc, char **argv, int *pargc, char ***pargv)
> {
>     int i;
>+    if (size_overflow_p (xtimes (argc, sizeof (char *)))) {
>+	*pargc = 0;
>+	*pargv = NULL;
>+	error (0, 0, "expand_wild: too many arguments");
>+	return;
>+    }
>     *pargc = argc;
>-    *pargv = (char **) xmalloc (argc * sizeof (char *));
>+    *pargv = xmalloc (xtimes (argc, sizeof (char *)));
>     for (i = 0; i < argc; ++i)
> 	(*pargv)[i] = xstrdup (argv[i]);
> }
>Index: src/history.c
>===================================================================
>RCS file: /cvsroot/ccvs/src/history.c,v
>retrieving revision 1.73
>diff -u -p -r1.73 history.c
>--- src/history.c	15 May 2004 23:10:22 -0000	1.73
>+++ src/history.c	28 May 2004 18:54:32 -0000
>@@ -412,8 +412,11 @@ history (int argc, char **argv)
> 		working = 1;
> 		break;
> 	    case 'X':			/* Undocumented debugging flag */
>+#ifdef DEBUG
> 		histfile = optarg;
>+#endif
> 		break;
>+
> 	    case 'D':			/* Since specified date */
> 		if (*since_rev || *since_tag || *backto)
> 		{
>@@ -898,9 +901,14 @@ save_user (char *name)
> {
>     if (user_count == user_max)
>     {
>-	user_max += USER_INCREMENT;
>-	user_list = (char **) xrealloc ((char *) user_list,
>-					(int) user_max * sizeof (char *));
>+	if (size_overflow_p (xtimes (xsum (user_max, USER_INCREMENT),
>+	                             sizeof (char *))))
>+	{
>+	    error (0, 0, "save_user: too many users");
>+	    return;
>+	}
>+	user_max = xsum (user_max, USER_INCREMENT);
>+	user_list = xrealloc (user_list, xtimes (user_max, sizeof (char *)));
>     }
>     user_list[user_count++] = xstrdup (name);
> }
>@@ -925,9 +933,14 @@ save_file (char *dir, char *name, char *
> 
>     if (file_count == file_max)
>     {
>-	file_max += FILE_INCREMENT;
>-	file_list = (struct file_list_str *) xrealloc ((char *) file_list,
>-						   file_max * sizeof (*fl));
>+	if (size_overflow_p (xtimes (xsum (file_max, FILE_INCREMENT),
>+	                             sizeof (*fl))))
>+	{
>+	    error (0, 0, "save_file: too many files");
>+	    return;
>+	}
>+	file_max = xsum (file_max, FILE_INCREMENT);
>+	file_list = xrealloc (file_list, xtimes (file_max, sizeof (*fl)));
>     }
>     fl = &file_list[file_count++];
>     fl->l_file = cp = xmalloc (strlen (dir) + strlen (name) + 2);
>@@ -965,9 +978,14 @@ save_module (char *module)
> {
>     if (mod_count == mod_max)
>     {
>-	mod_max += MODULE_INCREMENT;
>-	mod_list = (char **) xrealloc ((char *) mod_list,
>-				       mod_max * sizeof (char *));
>+	if (size_overflow_p (xtimes (xsum (mod_max, MODULE_INCREMENT),
>+	                             sizeof (char *))))
>+	{
>+	    error (0, 0, "save_module: too many modules");
>+	    return;
>+	}
>+	mod_max = xsum (mod_max, MODULE_INCREMENT);
>+	mod_list = xrealloc (mod_list, xtimes (mod_max, sizeof (char *)));
>     }
>     mod_list[mod_count++] = xstrdup (module);
> }
>Index: src/server.c
>===================================================================
>RCS file: /cvsroot/ccvs/src/server.c,v
>retrieving revision 1.363
>diff -u -p -r1.363 server.c
>--- src/server.c	20 May 2004 03:00:44 -0000	1.363
>+++ src/server.c	28 May 2004 18:34:36 -0000
>@@ -886,7 +886,7 @@ serve_max_dotdot (char *arg)
>     int i;
>     char *p;
> 
>-    if (lim < 0)
>+    if (lim < 0 || lim > 10000)
> 	return;
>     p = xmalloc (strlen (server_temp_dir) + 2 * lim + 10);
>     if (p == NULL)
>@@ -2011,6 +2011,9 @@ serve_notify (char *arg)
>     {
> 	char *cp;
> 
>+	if (!data[0])
>+	    goto error;
>+
> 	if (strchr (data, '+'))
> 	    goto error;
> 
>@@ -2143,6 +2146,14 @@ serve_argument (char *arg)
>     char *p;
> 
>     if (error_pending()) return;
>+    
>+    if (argument_count >= 10000)
>+    {
>+	if (alloc_pending (80))
>+	    sprintf (pending_error_text, 
>+		     "E Protocol error: too many arguments");
>+	return;
>+    }
> 
>     if (argument_vector_size <= argument_count)
>     {
>@@ -2172,6 +2183,14 @@ serve_argumentx (char *arg)
>     char *p;
> 
>     if (error_pending()) return;
>+    
>+    if (argument_count <= 1) 
>+    {
>+	if (alloc_pending (80))
>+	    sprintf (pending_error_text,
>+		     "E Protocol error: called argumentx without prior call to argument");
>+	return;
>+    }
> 
>     p = argument_vector[argument_count - 1];
>     p = xrealloc (p, strlen (p) + 1 + strlen (arg) + 1);
>@@ -2498,7 +2517,7 @@ check_command_valid_p (char *cmd_name)
>                     save some code here...  -kff */
> 
>                  /* Chop newline by hand, for strcmp()'s sake. */
>-                 if (linebuf[num_red - 1] == '\n')
>+                 if (num_red > 0 && linebuf[num_red - 1] == '\n')
>                      linebuf[num_red - 1] = '\0';
> 
>                  if (strcmp (linebuf, CVS_Username) == 0)
>@@ -2553,7 +2572,7 @@ check_command_valid_p (char *cmd_name)
> 	 while ((num_red = getline (&linebuf, &linebuf_len, fp)) >= 0)
> 	 {
> 	     /* Chop newline by hand, for strcmp()'s sake. */
>-	     if (linebuf[num_red - 1] == '\n')
>+	     if (num_red > 0 && linebuf[num_red - 1] == '\n')
> 		 linebuf[num_red - 1] = '\0';
> 
> 	     if (strcmp (linebuf, CVS_Username) == 0)
>Index: src/wrapper.c
>===================================================================
>RCS file: /cvsroot/ccvs/src/wrapper.c,v
>retrieving revision 1.37
>diff -u -p -r1.37 wrapper.c
>--- src/wrapper.c	18 Feb 2004 04:46:08 -0000	1.37
>+++ src/wrapper.c	28 May 2004 15:43:41 -0000
>@@ -235,6 +235,30 @@ wrap_unparse_rcs_options (char **line, i
> #endif /* SERVER_SUPPORT || CLIENT_SUPPORT */
> 
> /*
>+ * Remove fmt str specifier other than %% or %s. And allow
>+ * only max_s %s specifiers
>+ */
>+wrap_clean_fmt_str(char *fmt, int max_s)
>+{
>+    while (*fmt) {
>+	if (fmt[0] == '%' && fmt[1])
>+	{
>+	    if (fmt[1] == '%') 
>+		fmt++;
>+	    else
>+		if (fmt[1] == 's' && max_s > 0)
>+		{
>+		    max_s--;
>+		    fmt++;
>+		} else 
>+		    *fmt = ' ';
>+	}
>+	fmt++;
>+    }
>+    return;
>+}
>+
>+/*
>  * Open a file and read lines, feeding each line to a line parser. Arrange
>  * for keeping a temporary list of wrappers at the end, if the "temp"
>  * argument is set.
>@@ -540,9 +564,8 @@ wrap_tocvs_process_file(const char *file
>     args = xmalloc (strlen (e->tocvsFilter)
> 		    + strlen (fileName)
> 		    + strlen (buf));
>-    /* FIXME: sprintf will blow up if the format string contains items other
>-       than %s, or contains too many %s's.  We should instead be parsing
>-       e->tocvsFilter ourselves and giving a real error.  */
>+
>+    wrap_clean_fmt_str(e->tocvsFilter, 2);
>     sprintf (args, e->tocvsFilter, fileName, buf);
>     run_setup (args);
>     run_exec(RUN_TTY, RUN_TTY, RUN_TTY, RUN_NORMAL|RUN_REALLY );
>@@ -572,9 +595,8 @@ wrap_fromcvs_process_file(const char *fi
> 
>     args = xmalloc (strlen (e->fromcvsFilter)
> 		    + strlen (fileName));
>-    /* FIXME: sprintf will blow up if the format string contains items other
>-       than %s, or contains too many %s's.  We should instead be parsing
>-       e->fromcvsFilter ourselves and giving a real error.  */
>+
>+    wrap_clean_fmt_str(e->fromcvsFilter, 1);
>     sprintf (args, e->fromcvsFilter, fileName);
>     run_setup (args);
>     run_exec(RUN_TTY, RUN_TTY, RUN_TTY, RUN_NORMAL );

Actions: View | Diff

Attachments on bug 54773: 18913 | 18919 | 18920 | 19603 | 20020 | 20405 | 20524 | 20697