Re: patch(1): infinite loop on malformed ed script input

On Mon, 06 Apr 2026 15:05:11 +0200,
Renaud Allard <[email protected]> wrote:
> 
> On Sat, Apr 05, 2026, Kirill A. Korinsky wrote:
> > another_hunk() exists with false when out_of_mem
> > becames true, and old code just moved to the next
> > hunk.  After your diff it thinks that it is a loop
> > and exists.
> 
> The stall only happens in the ed script path
> (do_ed_script + continue).  The OOM retry goes through
> another_hunk() which is a separate code path below the
> ed script continue.  do_ed_script() does not set
> out_of_mem.
> 
> Quite simple over the former patch. What do you think?
>

Ideologically I'd like to suggest tortoise-hare algorithm, but current
version reads OK @kirill if anyone willing to commit it.

> Index: usr.bin/patch/pch.c
> ===================================================================
> RCS file: /cvs/src/usr.bin/patch/pch.c,v
> retrieving revision 1.66
> diff -u -p -r1.66 pch.c
> --- usr.bin/patch/pch.c	12 Jul 2023 15:45:34 -0000	1.66
> +++ usr.bin/patch/pch.c
> @@ -180,6 +180,7 @@ static char	*posix_name(const struct fil
>  bool
>  there_is_another_patch(void)
>  {
> +	static off_t prev_p_base = -1;
>  	bool exists = false;
> 
>  	if (p_base != 0 && p_base >= p_filesize) {
> @@ -190,6 +191,12 @@ there_is_another_patch(void)
>  	if (verbose)
>  		say("Hmm...");
>  	diff_type = intuit_diff_type();
> +	if (diff_type == ED_DIFF && p_base == prev_p_base) {
> +		if (verbose)
> +			say("  Ignoring the trailing garbage.\ndone\n");
> +		return false;
> +	}
> +	prev_p_base = p_base;
>  	if (!diff_type) {
>  		if (p_base != 0) {
>  			if (verbose)
> 

-- 
wbr, Kirill