[Cvs-cvs] ccvs/src ChangeLog history.c [cvs1-11-x-branch]

[Derek Robert Price]

CVSROOT:        /cvsroot/cvs
Module name:    ccvs
Branch:         cvs1-11-x-branch
Changes by:     Derek Robert Price <address@hidden>     06/02/01 21:15:48

Modified files:
        src            : ChangeLog history.c 

Log message:
        * history.c (save_user, save_file, save_mod, read_hrecs): Avoid
        overflow.

CVSWeb URLs:
http://cvs.savannah.gnu.org/viewcvs/cvs/ccvs/src/ChangeLog.diff?only_with_tag=cvs1-11-x-branch&tr1=1.2336.2.416&tr2=1.2336.2.417&r1=text&r2=text
http://cvs.savannah.gnu.org/viewcvs/cvs/ccvs/src/history.c.diff?only_with_tag=cvs1-11-x-branch&tr1=1.58.4.13&tr2=1.58.4.14&r1=text&r2=text

Patches:
Index: ccvs/src/ChangeLog
diff -u ccvs/src/ChangeLog:1.2336.2.416 ccvs/src/ChangeLog:1.2336.2.417
--- ccvs/src/ChangeLog:1.2336.2.416     Mon Jan 30 23:32:23 2006
+++ ccvs/src/ChangeLog  Wed Feb  1 21:15:47 2006
@@ -1,3 +1,8 @@
+2006-02-01  Derek Price  <address@hidden>
+
+       * history.c (save_user, save_file, save_mod, read_hrecs): Avoid
+       overflow.
+
 2006-01-30  Derek Price  <address@hidden>
 
        * server.c (do_cvs_command): Set flow control pipe to blocking mode
Index: ccvs/src/history.c
diff -u ccvs/src/history.c:1.58.4.13 ccvs/src/history.c:1.58.4.14
--- ccvs/src/history.c:1.58.4.13        Tue Jul 12 14:07:54 2005
+++ ccvs/src/history.c  Wed Feb  1 21:15:48 2006
@@ -266,24 +266,24 @@
    we do.  */
 static char *rec_types;
 
-static int hrec_count;
-static int hrec_max;
+static size_t hrec_count;
+static size_t hrec_max;
 
 static char **user_list;       /* Ptr to array of ptrs to user names */
-static int user_max;           /* Number of elements allocated */
-static int user_count;         /* Number of elements used */
+static size_t user_max;                /* Number of elements allocated */
+static size_t user_count;              /* Number of elements used */
 
 static struct file_list_str
 {
     char *l_file;
     char *l_module;
 } *file_list;                  /* Ptr to array file name structs */
-static int file_max;           /* Number of elements allocated */
-static int file_count;         /* Number of elements used */
+static size_t file_max;                /* Number of elements allocated */
+static size_t file_count;              /* Number of elements used */
 
 static char **mod_list;                /* Ptr to array of ptrs to module names 
*/
-static int mod_max;            /* Number of elements allocated */
-static int mod_count;          /* Number of elements used */
+static size_t mod_max;         /* Number of elements allocated */
+static size_t mod_count;       /* Number of elements used */
 
 static char *histfile;         /* Ptr to the history file name */
 
@@ -926,7 +926,8 @@
     if (user_count == user_max)
     {
        user_max = xsum (user_max, USER_INCREMENT);
-       if (size_overflow_p (xtimes (user_max, sizeof (char *))))
+       if (user_count == user_max
+           || size_overflow_p (xtimes (user_max, sizeof (char *))))
        {
            error (0, 0, "save_user: too many users");
            return;
@@ -960,7 +961,8 @@
     if (file_count == file_max)
     {
        file_max = xsum (file_max, FILE_INCREMENT);
-       if (size_overflow_p (xtimes (file_max, sizeof (*fl))))
+       if (file_count == file_max
+           || size_overflow_p (xtimes (file_max, sizeof (*fl))))
        {
            error (0, 0, "save_file: too many files");
            return;
@@ -1007,7 +1009,8 @@
     if (mod_count == mod_max)
     {
        mod_max = xsum (mod_max, MODULE_INCREMENT);
-       if (size_overflow_p (xtimes (mod_max, sizeof (char *))))
+       if (mod_count == mod_max
+           || size_overflow_p (xtimes (mod_max, sizeof (char *))))
        {
            error (0, 0, "save_module: too many modules");
            return;
@@ -1160,9 +1163,13 @@
        {
            struct hrec *old_head = hrec_head;
 
-           hrec_max += HREC_INCREMENT;
-           hrec_head = xrealloc ((char *) hrec_head,
-                                 hrec_max * sizeof (struct hrec));
+           hrec_max = xsum (hrec_max, HREC_INCREMENT);
+           if (hrec_count == hrec_max
+               || size_overflow_p (xtimes (hrec_max, sizeof (struct hrec))))
+               error (1, 0, "Too many history records in history file.");
+
+           hrec_head = xrealloc (hrec_head,
+                                 xtimes (hrec_max, sizeof (struct hrec)));
            if (last_since_tag)
                last_since_tag = hrec_head + (last_since_tag - old_head);
            if (last_backto)