svn commit: r1936337 - subversion/trunk/subversion/libsvn_repos

Author: dsahlberg
Date: Sun Jul 19 21:42:43 2026
New Revision: 1936337

Log:
Parse dumpfile property length as unsigned integers.
This rejects negative lengths such as "V -1" before
they are cast to apr_size_t.

"K len" was already changed like this in r995828.

Also limit the accepted value length to APR_SIZE_MAX - 1,
so that the len + 1 allocation in read_key_or_val() cannot wrap.
This applies to both "K" and "D" as well.

Patch by: Guanqiang Han <hanguanqiang-UOlijcLmZ/[email protected]> (tweaked by me)

Modified:
   subversion/trunk/subversion/libsvn_repos/load.c

Modified: subversion/trunk/subversion/libsvn_repos/load.c
==============================================================================
--- subversion/trunk/subversion/libsvn_repos/load.c	Sun Jul 19 19:35:54 2026	(r1936336)
+++ subversion/trunk/subversion/libsvn_repos/load.c	Sun Jul 19 21:42:43 2026	(r1936337)
@@ -215,7 +215,7 @@ parse_property_block(svn_stream_t *strea
           char *keybuf;
           apr_uint64_t len;
 
-          SVN_ERR(svn_cstring_strtoui64(&len, buf + 2, 0, APR_SIZE_MAX, 10));
+          SVN_ERR(svn_cstring_strtoui64(&len, buf + 2, 0, APR_SIZE_MAX - 1, 10));
           SVN_ERR(read_key_or_val(&keybuf, actual_length,
                                   stream, (apr_size_t)len, proppool));
 
@@ -231,9 +231,9 @@ parse_property_block(svn_stream_t *strea
             {
               svn_string_t propstring;
               char *valbuf;
-              apr_int64_t val;
+              apr_uint64_t val;
 
-              SVN_ERR(svn_cstring_atoi64(&val, buf + 2));
+              SVN_ERR(svn_cstring_strtoui64(&val, buf + 2, 0, APR_SIZE_MAX - 1, 10));
               propstring.len = (apr_size_t)val;
               SVN_ERR(read_key_or_val(&valbuf, actual_length,
                                       stream, propstring.len, proppool));
@@ -261,7 +261,7 @@ parse_property_block(svn_stream_t *strea
           char *keybuf;
           apr_uint64_t len;
 
-          SVN_ERR(svn_cstring_strtoui64(&len, buf + 2, 0, APR_SIZE_MAX, 10));
+          SVN_ERR(svn_cstring_strtoui64(&len, buf + 2, 0, APR_SIZE_MAX - 1, 10));
           SVN_ERR(read_key_or_val(&keybuf, actual_length,
                                   stream, (apr_size_t)len, proppool));