svn commit: r1932998 - subversion/trunk/subversion/svnbrowse

Author: rinrab
Date: Sun Apr 12 18:48:55 2026
New Revision: 1932998

Log:
svnbrowse: Check that padding is positive so we don't SEGFAULT trying to
allocate (size_t)(int)(-42) bytes of memory (which evaluates to a huge
number).

* subversion/svnbrowse/svnbrowse.c
  (rightpad, leftpad): Check if padding is negative.

Modified:
   subversion/trunk/subversion/svnbrowse/svnbrowse.c

Modified: subversion/trunk/subversion/svnbrowse/svnbrowse.c
==============================================================================
--- subversion/trunk/subversion/svnbrowse/svnbrowse.c	Sun Apr 12 18:45:03 2026	(r1932997)
+++ subversion/trunk/subversion/svnbrowse/svnbrowse.c	Sun Apr 12 18:48:55 2026	(r1932998)
@@ -222,7 +222,12 @@ static char *
 rightpad(const char *cstr, int padding, apr_pool_t *result_pool)
 {
   int len = strlen(cstr);
-  char *result = apr_palloc(result_pool, padding + 1);
+  char *result;
+
+  if (padding < 0)
+    padding = 0;
+
+  result = apr_palloc(result_pool, padding + 1);
 
   if (len < padding)
     {
@@ -242,7 +247,12 @@ static char *
 leftpad(const char *cstr, int padding, apr_pool_t *result_pool)
 {
   int len = strlen(cstr);
-  char *result = apr_palloc(result_pool, padding + 1);
+  char *result;
+
+  if (padding < 0)
+    padding = 0;
+
+  result = apr_palloc(result_pool, padding + 1);
 
   if (len < padding)
     {