{"thread":{"id":"6982","subject":"[PATCH] diff --cc: integer overflow given a 2GB-or-larger file","startedAt":"2007-02-26T23:11:35Z","lastAt":"2007-02-26T23:11:35Z","messageCount":1,"participants":["Jim Meyering"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"35552","messageId":"87vehopl94.fsf@rho.meyering.net","threadId":"6982","inReplyTo":null,"subject":"[PATCH] diff --cc: integer overflow given a 2GB-or-larger file","fromName":"Jim Meyering","fromEmail":"jim@meyering.net","sentAt":"2007-02-26T23:11:35Z","receivedAt":"2007-02-26T23:11:35Z","isPatch":true,"sender":{"key":"jim@meyering.net","avatar":"https://avatars.githubusercontent.com/u/710630?v=4"},"body":"Few of us use git to compare or even version-control 2GB files,\nbut when we do, we'll want it to work.\n\nReading a recent patch, I noticed two lines like this:\n\n   int len = st.st_size;\n\nInstead of \"int\", that should be \"size_t\".  Otherwise, in the\nnon-symlink case, with 64-bit size_t, if the file's size is 2GB,\nthe following xmalloc will fail:\n\n   result = xmalloc(len + 1);\n\ntrying to allocate 2^64 - 2^31 + 1 bytes (assuming sign-extension\nin the int-to-size_t promotion).  And even if it didn't fail, the\nsubsequent \"result[len] = 0;\" would be equivalent to an unpleasant\n\"result[-2147483648] = 0;\"\n\nThe other nearby \"int\"-declared size variable, sz, should also be of\ntype size_t, for the same reason.  If sz ever wraps around and becomes\nnegative, xread will corrupt memory _before_ the \"result\" buffer.\n\nSigned-off-by: Jim Meyering <jim@meyering.net>\n---\n combine-diff.c |    6 +++---\n 1 files changed, 3 insertions(+), 3 deletions(-)\n\ndiff --git a/combine-diff.c b/combine-diff.c\nindex 6b7c6be..044633d 100644\n--- a/combine-diff.c\n+++ b/combine-diff.c\n@@ -684,7 +684,7 @@ static void show_patch_diff(struct combine_diff_path *elem, int num_parent,\n \t\t\tgoto deleted_file;\n \n \t\tif (S_ISLNK(st.st_mode)) {\n-\t\t\tint len = st.st_size;\n+\t\t\tsize_t len = st.st_size;\n \t\t\tresult_size = len;\n \t\t\tresult = xmalloc(len + 1);\n \t\t\tif (result_size != readlink(elem->path, result, len)) {\n@@ -697,8 +697,8 @@ static void show_patch_diff(struct combine_diff_path *elem, int num_parent,\n \t\t}\n \t\telse if (0 <= (fd = open(elem->path, O_RDONLY)) &&\n \t\t\t !fstat(fd, &st)) {\n-\t\t\tint len = st.st_size;\n-\t\t\tint sz = 0;\n+\t\t\tsize_t len = st.st_size;\n+\t\t\tsize_t sz = 0;\n \n \t\t\telem->mode = canon_mode(st.st_mode);\n \t\t\tresult_size = len;\n-- \n1.5.0.1.226.g7bd59\n"}]}