D7597: dirs: fix out-of-bounds access in Py3

[martinvonz (Martin von Zweigbergk)]

Closed by commit rHGa47ccdcce4f9: dirs: fix out-of-bounds access in Py3 
(authored by martinvonz).
This revision was automatically updated to reflect the committed changes.

REPOSITORY
  rHG Mercurial

CHANGES SINCE LAST UPDATE
  https://phab.mercurial-scm.org/D7597?vs=18591=18602

CHANGES SINCE LAST ACTION
  https://phab.mercurial-scm.org/D7597/new/

REVISION DETAIL
  https://phab.mercurial-scm.org/D7597

AFFECTED FILES
  mercurial/cext/dirs.c

CHANGE DETAILS

diff --git a/mercurial/cext/dirs.c b/mercurial/cext/dirs.c
--- a/mercurial/cext/dirs.c
+++ b/mercurial/cext/dirs.c
@@ -14,7 +14,7 @@
 #include "util.h"
 
 #ifdef IS_PY3K
-#define PYLONG_VALUE(o) ((PyLongObject *)o)->ob_digit[1]
+#define PYLONG_VALUE(o) ((PyLongObject *)o)->ob_digit[0]
 #else
 #define PYLONG_VALUE(o) PyInt_AS_LONG(o)
 #endif



To: martinvonz, #hg-reviewers, spectral, pulkit
Cc: mercurial-devel
___
Mercurial-devel mailing list
Mercurial-devel@mercurial-scm.org
https://www.mercurial-scm.org/mailman/listinfo/mercurial-devel

D7597: dirs: fix out-of-bounds access in Py3

[martinvonz (Martin von Zweigbergk)]

martinvonz created this revision.
Herald added a subscriber: mercurial-devel.
Herald added a reviewer: hg-reviewers.

REVISION SUMMARY
  The hack for mutating Python's variable-length integers that was
  ported to py3 in cb3048746dae 
 
(dirs: port PyInt code to work on Python
  3, 2016-10-08) was reading from ob_digit[1] instead of ob_digit[0] for
  some reason. Space for ob_digit[1] would only be allocated for
  integers larger than 30 bits, so we ended up writing to unallocated
  memory. Also, we would write an integer that's 2^30 too large, so we
  would never free these integers.
  
  Found by AddressSanitizer.

REPOSITORY
  rHG Mercurial

BRANCH
  default

REVISION DETAIL
  https://phab.mercurial-scm.org/D7597

AFFECTED FILES
  mercurial/cext/dirs.c

CHANGE DETAILS

diff --git a/mercurial/cext/dirs.c b/mercurial/cext/dirs.c
--- a/mercurial/cext/dirs.c
+++ b/mercurial/cext/dirs.c
@@ -14,7 +14,7 @@
 #include "util.h"
 
 #ifdef IS_PY3K
-#define PYLONG_VALUE(o) ((PyLongObject *)o)->ob_digit[1]
+#define PYLONG_VALUE(o) ((PyLongObject *)o)->ob_digit[0]
 #else
 #define PYLONG_VALUE(o) PyInt_AS_LONG(o)
 #endif



To: martinvonz, #hg-reviewers
Cc: mercurial-devel
___
Mercurial-devel mailing list
Mercurial-devel@mercurial-scm.org
https://www.mercurial-scm.org/mailman/listinfo/mercurial-devel