Re: patch(1): infinite loop on malformed ed script input

On Sat, Apr 05, 2026, Kirill A. Korinsky wrote:
> another_hunk() exists with false when out_of_mem
> becames true, and old code just moved to the next
> hunk.  After your diff it thinks that it is a loop
> and exists.

The stall only happens in the ed script path
(do_ed_script + continue).  The OOM retry goes through
another_hunk() which is a separate code path below the
ed script continue.  do_ed_script() does not set
out_of_mem.

Quite simple over the former patch. What do you think?

Index: usr.bin/patch/pch.c
===================================================================
RCS file: /cvs/src/usr.bin/patch/pch.c,v
retrieving revision 1.66
diff -u -p -r1.66 pch.c
--- usr.bin/patch/pch.c	12 Jul 2023 15:45:34 -0000	1.66
+++ usr.bin/patch/pch.c
@@ -180,6 +180,7 @@ static char	*posix_name(const struct fil
 bool
 there_is_another_patch(void)
 {
+	static off_t prev_p_base = -1;
 	bool exists = false;

 	if (p_base != 0 && p_base >= p_filesize) {
@@ -190,6 +191,12 @@ there_is_another_patch(void)
 	if (verbose)
 		say("Hmm...");
 	diff_type = intuit_diff_type();
+	if (diff_type == ED_DIFF && p_base == prev_p_base) {
+		if (verbose)
+			say("  Ignoring the trailing garbage.\ndone\n");
+		return false;
+	}
+	prev_p_base = p_base;
 	if (!diff_type) {
 		if (p_base != 0) {
 			if (verbose)