diff -ru mercurial-2.6.2/mercurial/mpatch.c mercurial-2.6.2_patched/mercurial/mpatch.c

--- mercurial-2.6.2/mercurial/mpatch.c	2013-06-02 00:10:16.000000000 +0200

+++ mercurial-2.6.2_patched/mercurial/mpatch.c	2019-05-07 16:51:13.631774481 +0200

@@ -74,6 +74,35 @@

 	return a->tail - a->head;

 }

+/* add helper to add src and *dest iff it won't overflow */

+static inline int safeadd(int src, int *dest)

+{

+	if ((src > 0) == (*dest > 0)) {

+		if (*dest > 0) {

+			if (src > (INT_MAX - *dest)) {

+				return 0;

+			}

+		} else {

+			if (src < (INT_MIN - *dest)) {

+				return 0;

+			}

+		}

+	}

+	*dest += src;

+	return 1;

+}

+

+/* subtract src from dest and store result in dest */

+static inline int safesub(int src, int *dest)

+{

+	if (((src > 0) && (*dest < INT_MIN + src)) ||

+	    ((src < 0) && (*dest > INT_MAX + src))) {

+		return 0;

+	}

+	*dest -= src;

+	return 1;

+}

+

 /* move hunks in source that are less cut to dest, compensating

    for changes in offset. the last hunk may be split if necessary.

 */

@@ -83,18 +112,37 @@

 	int postend, c, l;

 	while (s != src->tail) {

-		if (s->start + offset >= cut)

+		int soffset = s->start;

+		if (!safeadd(offset, &soffset))

+			break; /* add would overflow, oh well */

+		if (soffset >= cut)

 			break; /* we've gone far enough */

-		postend = offset + s->start + s->len;

+		postend = offset;

+		if (!safeadd(s->start, &postend) ||

+		    !safeadd(s->len, &postend)) {

+			break;

+		}

 		if (postend <= cut) {

 			/* save this hunk */

-			offset += s->start + s->len - s->end;

+			int tmp = s->start;

+			if (!safesub(s->end, &tmp)) {

+				break;

+			}

+			if (!safeadd(s->len, &tmp)) {

+				break;

+			}

+			if (!safeadd(tmp, &offset)) {

+				break; /* add would overflow, oh well */

+			}

 			*d++ = *s++;

 		}

 		else {

 			/* break up this hunk */

-			c = cut - offset;

+			c = cut;

+			if (!safesub(offset, &c)) {

+				break;

+			}

 			if (s->end < c)

 				c = s->end;

 			l = cut - offset - s->start;

@@ -128,16 +176,40 @@

 	int postend, c, l;

 	while (s != src->tail) {

-		if (s->start + offset >= cut)

+		int cmpcut = s->start;

+		if (!safeadd(offset, &cmpcut)) {

+			break;

+		}

+		if (cmpcut >= cut)

 			break;

-		postend = offset + s->start + s->len;

+		postend = offset;

+		if (!safeadd(s->start, &postend)) {

+			break;

+		}

+		if (!safeadd(s->len, &postend)) {

+			break;

+		}

 		if (postend <= cut) {

-			offset += s->start + s->len - s->end;

+			/* do the subtraction first to avoid UB integer overflow

+			 */

+			int tmp = s->start;

+			if (!safesub(s->end, &tmp)) {

+				break;

+			}

+			if (!safeadd(s->len, &tmp)) {

+				break;

+			}

+			if (!safeadd(tmp, &offset)) {

+				break;

+			}

 			s++;

 		}

 		else {

-			c = cut - offset;

+			c = cut;

+			if (!safesub(offset, &c)) {

+				break;

+			}

 			if (s->end < c)

 				c = s->end;

 			l = cut - offset - s->start;

@@ -179,8 +251,18 @@

 			/* insert new hunk */

 			ct = c->tail;

-			ct->start = bh->start - offset;

-			ct->end = bh->end - post;

+			ct->start = bh->start;

+			ct->end = bh->end;

+			if (!safesub(offset, &(ct->start)) ||

+			    !safesub(post, &(ct->end))) {

+				/* It was already possible to exit

+				 * this function with a return value

+				 * of NULL before the safesub()s were

+				 * added, so this should be fine. */

+				lfree(c);

+				c = NULL;

+				goto done;

+			}

 			ct->len = bh->len;

 			ct->data = bh->data;

 			c->tail++;

@@ -191,7 +273,7 @@

 		memcpy(c->tail, a->head, sizeof(struct frag) * lsize(a));

 		c->tail += lsize(a);

 	}

-

+done:

 	lfree(a);

 	lfree(b);

 	return c;

@@ -215,13 +297,17 @@

 		lt->start = getbe32(bin);

 		lt->end = getbe32(bin + 4);

 		lt->len = getbe32(bin + 8);

-		if (lt->start > lt->end)

-			break; /* sanity check */

-		bin = data + lt->len;

-		if (bin < data)

+		if (lt->start < 0 || lt->start > lt->end || lt->len < 0)

+ 			break; /* sanity check */

+		bin = data;

+		if (!safeadd(lt->len, &bin)) {

 			break; /* big data + big (bogus) len can wrap around */

+		}

 		lt->data = data;

-		data = bin + 12;

+		data = bin;

+		if (!safeadd(12, &data)) {

+			break;

+		}

 		lt++;

 	}

@@ -266,7 +352,8 @@

 	char *p = buf;

 	while (f != l->tail) {

-		if (f->start < last || f->end > len) {

+		if (f->start < last || f->start > len || f->end > len ||

+            last < 0) {

 			if (!PyErr_Occurred())

 				PyErr_SetString(mpatch_Error,

 				                "invalid patch");

@@ -279,6 +366,12 @@

 		p += f->len;

 		f++;

 	}

+	if (last < 0) {

+		if (!PyErr_Occurred())

+			PyErr_SetString(mpatch_Error,

+			                "invalid patch");

+		return 0;

+	}

 	memcpy(p, orig + last, len - last);

 	return 1;

 }