svn commit: r1936778 - in subversion/branches/1.15.x: . subversion/libsvn_repos

Author: svn-role
Date: Sat Aug  1 04:01:41 2026
New Revision: 1936778

Log:
Merge r1936337 from trunk:

* r1936337
  Parse dumpfile property length as unsigned integers. This rejects
  negative lengths such as "V -1" before they are cast to apr_size_t.
  Justification:
    Subversion shouldn't crash even if the dump file is corrupt
  Votes:
    +1: dsahlberg, ivan, kotkov

Modified:
   subversion/branches/1.15.x/   (props changed)
   subversion/branches/1.15.x/STATUS
   subversion/branches/1.15.x/subversion/libsvn_repos/load.c

Modified: subversion/branches/1.15.x/STATUS
==============================================================================
--- subversion/branches/1.15.x/STATUS	Sat Aug  1 04:01:33 2026	(r1936777)
+++ subversion/branches/1.15.x/STATUS	Sat Aug  1 04:01:41 2026	(r1936778)
@@ -66,11 +66,3 @@ Veto-blocked changes:
 
 Approved changes:
 =================
-
-* r1936337
-  Parse dumpfile property length as unsigned integers. This rejects
-  negative lengths such as "V -1" before they are cast to apr_size_t.
-  Justification:
-    Subversion shouldn't crash even if the dump file is corrupt
-  Votes:
-    +1: dsahlberg, ivan, kotkov

Modified: subversion/branches/1.15.x/subversion/libsvn_repos/load.c
==============================================================================
--- subversion/branches/1.15.x/subversion/libsvn_repos/load.c	Sat Aug  1 04:01:33 2026	(r1936777)
+++ subversion/branches/1.15.x/subversion/libsvn_repos/load.c	Sat Aug  1 04:01:41 2026	(r1936778)
@@ -215,7 +215,7 @@ parse_property_block(svn_stream_t *strea
           char *keybuf;
           apr_uint64_t len;
 
-          SVN_ERR(svn_cstring_strtoui64(&len, buf + 2, 0, APR_SIZE_MAX, 10));
+          SVN_ERR(svn_cstring_strtoui64(&len, buf + 2, 0, APR_SIZE_MAX - 1, 10));
           SVN_ERR(read_key_or_val(&keybuf, actual_length,
                                   stream, (apr_size_t)len, proppool));
 
@@ -231,9 +231,9 @@ parse_property_block(svn_stream_t *strea
             {
               svn_string_t propstring;
               char *valbuf;
-              apr_int64_t val;
+              apr_uint64_t val;
 
-              SVN_ERR(svn_cstring_atoi64(&val, buf + 2));
+              SVN_ERR(svn_cstring_strtoui64(&val, buf + 2, 0, APR_SIZE_MAX - 1, 10));
               propstring.len = (apr_size_t)val;
               SVN_ERR(read_key_or_val(&valbuf, actual_length,
                                       stream, propstring.len, proppool));
@@ -261,7 +261,7 @@ parse_property_block(svn_stream_t *strea
           char *keybuf;
           apr_uint64_t len;
 
-          SVN_ERR(svn_cstring_strtoui64(&len, buf + 2, 0, APR_SIZE_MAX, 10));
+          SVN_ERR(svn_cstring_strtoui64(&len, buf + 2, 0, APR_SIZE_MAX - 1, 10));
           SVN_ERR(read_key_or_val(&keybuf, actual_length,
                                   stream, (apr_size_t)len, proppool));