Author: rinrab
Date: Sun Apr 12 18:48:55 2026
New Revision: 1932998
Log:
svnbrowse: Check that padding is positive so we don't SEGFAULT trying to
allocate (size_t)(int)(-42) bytes of memory (which evaluates to a huge
number).
* subversion/svnbrowse/svnbrowse.c
(rightpad, leftpad): Check if padding is negative.
Modified:
subversion/trunk/subversion/svnbrowse/svnbrowse.c
Modified: subversion/trunk/subversion/svnbrowse/svnbrowse.c
==============================================================================
--- subversion/trunk/subversion/svnbrowse/svnbrowse.c Sun Apr 12 18:45:03
2026 (r1932997)
+++ subversion/trunk/subversion/svnbrowse/svnbrowse.c Sun Apr 12 18:48:55
2026 (r1932998)
@@ -222,7 +222,12 @@ static char *
rightpad(const char *cstr, int padding, apr_pool_t *result_pool)
{
int len = strlen(cstr);
- char *result = apr_palloc(result_pool, padding + 1);
+ char *result;
+
+ if (padding < 0)
+ padding = 0;
+
+ result = apr_palloc(result_pool, padding + 1);
if (len < padding)
{
@@ -242,7 +247,12 @@ static char *
leftpad(const char *cstr, int padding, apr_pool_t *result_pool)
{
int len = strlen(cstr);
- char *result = apr_palloc(result_pool, padding + 1);
+ char *result;
+
+ if (padding < 0)
+ padding = 0;
+
+ result = apr_palloc(result_pool, padding + 1);
if (len < padding)
{
