[PATCH] apply: reject binary hunks whose size does not fit in an int

[Elia Pinto <gitter.spiros@gmail.com>]

In parse_binary_hunk(), the declared size of a binary hunk ("literal N"
or "delta N") is read into an "unsigned long" and then stored in
struct fragment.size, which is an "int".

Reject binary hunks whose declared size does not fit in an "int",
treating them as corrupt patches before allocation and inflation, just
as done for other malformed hunks.

Add a test with a hunk that declares a size of 3000000000. It runs
"git apply" with GIT_ALLOC_LIMIT set, so that without this fix the
oversized allocation dies instead of the patch being reported as
corrupt, and the test fails.

Signed-off-by: Elia Pinto <gitter.spiros@gmail.com>
---
 apply.c                 |  4 ++++
 t/t4103-apply-binary.sh | 15 +++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/apply.c b/apply.c
index a0b7119c63..731955ad09 100644
--- a/apply.c
+++ b/apply.c
@@ -2115,6 +2115,10 @@ static struct fragment *parse_binary_hunk(struct apply_state *state,
 		size -= llen;
 	}
 
+	/* frag->size is an int */
+	if (origlen > INT_MAX)
+		goto corrupt;
+
 	CALLOC_ARRAY(frag, 1);
 	frag->patch = inflate_it(data, hunk_size, origlen);
 	frag->free_patch = 1;
diff --git a/t/t4103-apply-binary.sh b/t/t4103-apply-binary.sh
index bdd4ccf9e3..70d01aa1ab 100755
--- a/t/t4103-apply-binary.sh
+++ b/t/t4103-apply-binary.sh
@@ -199,4 +199,19 @@ test_expect_success 'reject unrecognized binary diff' '
 	EOF
 	test_cmp expect err
 '
+
+test_expect_success 'reject binary diff with size exceeding INT_MAX' '
+	cat >patch.big <<-\EOF &&
+	diff --git a/f b/f
+	new file mode 100644
+	index 0000000..7898192
+	GIT binary patch
+	literal 3000000000
+	HcmV<n00001
+
+	EOF
+	test_must_fail env GIT_ALLOC_LIMIT=1m git apply patch.big 2>err &&
+	test_grep "error: corrupt binary patch" err
+'
+
 test_done

base-commit: 50fe5cc63f9cd6e89b87a2c9ccf96a444f4cfdb7
prerequisite-patch-id: 7adb31b4c9809dff36602bd05e0798d21a72e629
prerequisite-patch-id: 3f37dc40500ff000618807bfa583bd31990716c2
prerequisite-patch-id: 0b6bd0f4812d2f3dc805049c69a4ac25b708cc5c
-- 
2.53.0