Mercurial > public > mercurial-scm > hg
diff mercurial/parsers.c @ 26018:c6115c30a376
reachableroots: verify type of each item of heads argument
Though PyInt_AS_LONG() can return a value no matter if it isn't an int object,
it could exceed the boundary of the underlying struct. I think C API should be
defensive to such errors.
| author | Yuya Nishihara <yuya@tcha.org> |
|---|---|
| date | Thu, 13 Aug 2015 18:59:49 +0900 |
| parents | 44705659da94 |
| children | a3d5da8b641e |
line wrap: on
line diff
--- a/mercurial/parsers.c Thu Aug 13 18:38:46 2015 +0900 +++ b/mercurial/parsers.c Thu Aug 13 18:59:49 2015 +0900 @@ -1166,7 +1166,9 @@ /* Populate tovisit with all the heads */ numheads = PyList_GET_SIZE(heads); for (i = 0; i < numheads; i++) { - revnum = PyInt_AS_LONG(PyList_GET_ITEM(heads, i)); + revnum = PyInt_AsLong(PyList_GET_ITEM(heads, i)); + if (revnum == -1 && PyErr_Occurred()) + goto bail; if (revnum + 1 < 0 || revnum + 1 >= len + 1) { PyErr_SetString(PyExc_IndexError, "head out of range"); goto bail;