Hi.
There is a security bug in 'subversion'.

This information is from 'vendor-sec'.

This bug is NOT PUBLIC.

The coordinated release date (CRD) is: 2009-08-07

More information can be found here:
	https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec

CVE number: CVE-2009-2411
CVE description: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2411

CVE number: CVE-2009-2412
CVE description: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2412


Original posting:


----- Forwarded message from "Hyrum K. Wright" <hyrum_wright@mail.utexas.edu> -----

Date: Wed, 5 Aug 2009 21:16:25 +0200
From: "Hyrum K. Wright" <hyrum_wright@mail.utexas.edu>
To: vendor-sec@lst.de
Reply-To: "Hyrum K. Wright" <hyrum_wright@mail.utexas.edu>
Subject: [vendor-sec] Confidential Subversion heap overflow vulnerability notification.
Errors-To: vendor-sec-admin@lst.de

This email is a confidential pre-notification of a security alert
for Subversion clients and servers.

Please *do not forward* any part of this mail to anyone.  The public
announcement is not until 06 August 2009 20:00 UTC, and we'd like
to keep the information embargoed until then.

You are receiving this mail because (we think) you distribute software
that uses the Subversion libraries or that you host a Subversion installation
used by a large number of users.  We believe that you might want to have your
software patched by the time this security hole is made public on 06 August.

If you no longer maintain Subversion-related packages or hosting, please reply
to this mail indicating who the appropriate contact would be for your
organization.

Below is our advisory, followed by patches to fix the problem.  The
patches apply to Subversion 1.5.6 and Subversion 1.6.3.  Subversion 1.5.7 and
Subversion 1.6.4 will be published on 06 August, differing from 1.5.6 and
1.6.3, respectively, by exactly these patches and nothing else, but you can
get an advance copy of the source distribution here:

  http://orac.ece.utexas.edu/pub/svn/1.5.7/
  http://orac.ece.utexas.edu/pub/svn/1.6.4/

(Log in with "svn" / "KEnuprE3".)

Here's the full advisory:

===========================================================================
  Subversion clients and servers up to 1.6.3 (inclusive) have heap
  overflow issues in the parsing of binary deltas.

Summary:
========

  Subversion clients and servers have multiple heap overflow issues in
  the parsing of binary deltas.  This is related to an allocation
  vulnerability in the APR library used by Subversion.

  Clients with commit access to a vulnerable server can cause a remote
  heap overflow; servers can cause a heap overflow on vulnerable
  clients that try to do a checkout or update.  

  This can lead to a DoS (an exploit has been tested) and to arbitrary
  code execution (no exploit tested, but the possibility is clear).

Known vulnerable:
=================

  Subversion clients and servers <= 1.5.6.
  Subversion clients and servers 1.6.0 through 1.6.3 (inclusive).

Known fixed:
============

  Subversion 1.6.4
  Subversion 1.5.7

  (Search for "Patch" below to see the patches from 1.6.3 -> 1.6.4 and
   1.5.6 -> 1.5.7.  Search for "Recommendations" to get URLs for the
   1.6.4 release and associated APR library patch.)

Details:
========

  The libsvn_delta library does not contain sufficient input validation
  of svndiff streams.  If a stream with large windows is processed,
  one of several integer overflows may lead to some boundary checks
  incorrectly passing, which in turn can lead to a heap overflow.

Severity:
=========

  A remote attacker with commit access to repository may be able to
  execute code on a Subversion server.  A malicious server may be able to
  execute code on a Subversion client.

Recommendations:
================

  We recommend all users to upgrade to Subversion 1.6.4.
  
  We recommend all users to upgrade to the latest versions of APR and
  APR-UTIL, or apply the CVE-2009-2412 patch appropriate to their APR
  installation from <http://www.apache.org/dist/apr/patches/>.

  New Subversion packages can be found at:
  http://subversion.tigris.org/project_packages.html

References:
===========

  CVE-2009-2411  (Subversion)
  CVE-2009-2412  (APR)

Reported by:
============

  Matt Lewis, Google.

Patches:
========

  This patch applies to Subversion 1.6.x (apply with patch -p0 < patchfile):

[[[
Index: subversion/libsvn_delta/svndiff.c
===================================================================
--- subversion/libsvn_delta/svndiff.c (revision 38519)
+++ subversion/libsvn_delta/svndiff.c (working copy)
@@ -60,10 +60,23 @@ struct encoder_baton {
   apr_pool_t *pool;
 };
 
+/* This is at least as big as the largest size of an integer that
+   encode_int can generate; it is sufficient for creating buffers for
+   it to write into.  This assumes that integers are at most 64 bits,
+   and so 10 bytes (with 7 bits of information each) are sufficient to
+   represent them. */
+#define MAX_ENCODED_INT_LEN 10
+/* This is at least as big as the largest size for a single instruction. */
+#define MAX_INSTRUCTION_LEN (2*MAX_ENCODED_INT_LEN+1)
+/* This is at least as big as the largest possible instructions
+   section: in theory, the instructions could be SVN_DELTA_WINDOW_SIZE
+   1-byte copy-from-source instructions (though this is very unlikely). */
+#define MAX_INSTRUCTION_SECTION_LEN (SVN_DELTA_WINDOW_SIZE*MAX_INSTRUCTION_LEN)
 
 /* Encode VAL into the buffer P using the variable-length svndiff
    integer format.  Return the incremented value of P after the
-   encoded bytes have been written.
+   encoded bytes have been written.  P must point to a buffer of size
+   at least MAX_ENCODED_INT_LEN.
 
    This encoding uses the high bit of each byte as a continuation bit
    and the other seven bits as data bits.  High-order data bits are
@@ -85,7 +98,7 @@ encode_int(char *p, svn_filesize_t val)
   svn_filesize_t v;
   unsigned char cont;
 
-  assert(val >= 0);
+  SVN_ERR_ASSERT_NO_RETURN(val >= 0);
 
   /* Figure out how many bytes we'll need.  */
   v = val >> 7;
@@ -96,6 +109,8 @@ encode_int(char *p, svn_filesize_t val)
       n++;
     }
 
+  SVN_ERR_ASSERT_NO_RETURN(n <= MAX_ENCODED_INT_LEN);
+
   /* Encode the remaining bytes; n is always the number of bytes
      coming after the one we're encoding.  */
   while (--n >= 0)
@@ -112,7 +127,7 @@ encode_int(char *p, svn_filesize_t val)
 static void
 append_encoded_int(svn_stringbuf_t *header, svn_filesize_t val)
 {
-  char buf[128], *p;
+  char buf[MAX_ENCODED_INT_LEN], *p;
 
   p = encode_int(buf, val);
   svn_stringbuf_appendbytes(header, buf, p - buf);
@@ -168,7 +183,7 @@ window_handler(svn_txdelta_window_t *window, void
   svn_stringbuf_t *i1 = svn_stringbuf_create("", pool);
   svn_stringbuf_t *header = svn_stringbuf_create("", pool);
   const svn_string_t *newdata;
-  char ibuf[128], *ip;
+  char ibuf[MAX_INSTRUCTION_LEN], *ip;
   const svn_txdelta_op_t *op;
   apr_size_t len;
 
@@ -346,6 +361,8 @@ decode_file_offset(svn_filesize_t *val,
                    const unsigned char *p,
                    const unsigned char *end)
 {
+  if (p + MAX_ENCODED_INT_LEN < end)
+    end = p + MAX_ENCODED_INT_LEN;
   /* Decode bytes until we're done.  */
   *val = 0;
   while (p < end)
@@ -365,6 +382,8 @@ decode_size(apr_size_t *val,
             const unsigned char *p,
             const unsigned char *end)
 {
+  if (p + MAX_ENCODED_INT_LEN < end)
+    end = p + MAX_ENCODED_INT_LEN;
   /* Decode bytes until we're done.  */
   *val = 0;
   while (p < end)
@@ -382,7 +401,7 @@ decode_size(apr_size_t *val,
    data is not compressed.  */
 
 static svn_error_t *
-zlib_decode(svn_stringbuf_t *in, svn_stringbuf_t *out)
+zlib_decode(svn_stringbuf_t *in, svn_stringbuf_t *out, apr_size_t limit)
 {
   apr_size_t len;
   char *oldplace = in->data;
@@ -390,6 +409,13 @@ static svn_error_t *
   /* First thing in the string is the original length.  */
   in->data = (char *)decode_size(&len, (unsigned char *)in->data,
                                  (unsigned char *)in->data+in->len);
+  if (in->data == NULL)
+    return svn_error_create(SVN_ERR_SVNDIFF_INVALID_COMPRESSED_DATA, NULL,
+                            _("Decompression of svndiff data failed: no size"));
+  if (len > limit)
+    return svn_error_create(SVN_ERR_SVNDIFF_INVALID_COMPRESSED_DATA, NULL,
+                            _("Decompression of svndiff data failed: "
+                              "size too large"));
   /* We need to subtract the size of the encoded original length off the
    *      still remaining input length.  */
   in->len -= (in->data - oldplace);
@@ -487,10 +513,10 @@ count_and_verify_instructions(int *ninst,
         return svn_error_createf
           (SVN_ERR_SVNDIFF_INVALID_OPS, NULL,
            _("Invalid diff stream: insn %d cannot be decoded"), n);
-      else if (op.length <= 0)
+      else if (op.length == 0)
         return svn_error_createf
           (SVN_ERR_SVNDIFF_INVALID_OPS, NULL,
-           _("Invalid diff stream: insn %d has non-positive length"), n);
+           _("Invalid diff stream: insn %d has length zero"), n);
       else if (op.length > tview_len - tpos)
         return svn_error_createf
           (SVN_ERR_SVNDIFF_INVALID_OPS, NULL,
@@ -499,7 +525,8 @@ count_and_verify_instructions(int *ninst,
       switch (op.action_code)
         {
         case svn_txdelta_source:
-          if (op.length > sview_len - op.offset)
+          if (op.length > sview_len - op.offset ||
+              op.offset > sview_len)
             return svn_error_createf
               (SVN_ERR_SVNDIFF_INVALID_OPS, NULL,
                _("Invalid diff stream: "
@@ -565,11 +592,11 @@ decode_window(svn_txdelta_window_t *window, svn_fi
 
       instin = svn_stringbuf_ncreate((const char *)data, insend - data, pool);
       instout = svn_stringbuf_create("", pool);
-      SVN_ERR(zlib_decode(instin, instout));
+      SVN_ERR(zlib_decode(instin, instout, MAX_INSTRUCTION_SECTION_LEN));
 
       ndin = svn_stringbuf_ncreate((const char *)insend, newlen, pool);
       ndout = svn_stringbuf_create("", pool);
-      SVN_ERR(zlib_decode(ndin, ndout));
+      SVN_ERR(zlib_decode(ndin, ndout, SVN_DELTA_WINDOW_SIZE));
 
       newlen = ndout->len;
       data = (unsigned char *)instout->data;
@@ -685,6 +712,14 @@ write_handler(void *baton,
       if (p == NULL)
         return SVN_NO_ERROR;
 
+      if (tview_len > SVN_DELTA_WINDOW_SIZE ||
+          sview_len > SVN_DELTA_WINDOW_SIZE ||
+          /* for svndiff1, newlen includes the original length */
+          newlen > SVN_DELTA_WINDOW_SIZE + MAX_ENCODED_INT_LEN ||
+          inslen > MAX_INSTRUCTION_SECTION_LEN)
+        return svn_error_create(SVN_ERR_SVNDIFF_CORRUPT_WINDOW, NULL,
+                                _("Svndiff contains a too-large window"));
+
       /* Check for integer overflow.  */
       if (sview_offset < 0 || inslen + newlen < inslen
           || sview_len + tview_len < sview_len
@@ -841,6 +876,14 @@ read_window_header(svn_stream_t *stream, svn_files
   SVN_ERR(read_one_size(inslen, stream));
   SVN_ERR(read_one_size(newlen, stream));
 
+  if (*tview_len > SVN_DELTA_WINDOW_SIZE ||
+      *sview_len > SVN_DELTA_WINDOW_SIZE ||
+      /* for svndiff1, newlen includes the original length */
+      *newlen > SVN_DELTA_WINDOW_SIZE + MAX_ENCODED_INT_LEN ||
+      *inslen > MAX_INSTRUCTION_SECTION_LEN)
+    return svn_error_create(SVN_ERR_SVNDIFF_CORRUPT_WINDOW, NULL,
+                            _("Svndiff contains a too-large window"));
+
   /* Check for integer overflow.  */
   if (*sview_offset < 0 || *inslen + *newlen < *inslen
       || *sview_len + *tview_len < *sview_len
Index: subversion/libsvn_delta/text_delta.c
===================================================================
--- subversion/libsvn_delta/text_delta.c  (revision 38519)
+++ subversion/libsvn_delta/text_delta.c  (working copy)
@@ -548,7 +548,7 @@ svn_txdelta_target_push(svn_txdelta_window_handler
 /* Functions for applying deltas.  */
 
 /* Ensure that BUF has enough space for VIEW_LEN bytes.  */
-static APR_INLINE void
+static APR_INLINE svn_error_t *
 size_buffer(char **buf, apr_size_t *buf_size,
             apr_size_t view_len, apr_pool_t *pool)
 {
@@ -557,8 +557,11 @@ size_buffer(char **buf, apr_size_t *buf_size,
       *buf_size *= 2;
       if (*buf_size < view_len)
         *buf_size = view_len;
+      SVN_ERR_ASSERT(APR_ALIGN_DEFAULT(*buf_size) >= *buf_size);
       *buf = apr_palloc(pool, *buf_size);
     }
+
+  return SVN_NO_ERROR;
 }
 
 
@@ -659,7 +662,7 @@ apply_window(svn_txdelta_window_t *window, void *b
                          >= ab->sbuf_offset + ab->sbuf_len)));
 
   /* Make sure there's enough room in the target buffer.  */
-  size_buffer(&ab->tbuf, &ab->tbuf_size, window->tview_len, ab->pool);
+  SVN_ERR(size_buffer(&ab->tbuf, &ab->tbuf_size, window->tview_len, ab->pool));
 
   /* Prepare the source buffer for reading from the input stream.  */
   if (window->sview_offset != ab->sbuf_offset
@@ -668,7 +671,8 @@ apply_window(svn_txdelta_window_t *window, void *b
       char *old_sbuf = ab->sbuf;
 
       /* Make sure there's enough room.  */
-      size_buffer(&ab->sbuf, &ab->sbuf_size, window->sview_len, ab->pool);
+      SVN_ERR(size_buffer(&ab->sbuf, &ab->sbuf_size, window->sview_len,
+              ab->pool));
 
       /* If the existing view overlaps with the new view, copy the
        * overlap to the beginning of the new buffer.  */
]]]


  This patch applies to Subversion 1.5.x:

[[[
Index: subversion/libsvn_delta/svndiff.c
===================================================================
--- subversion/libsvn_delta/svndiff.c (revision 38498)
+++ subversion/libsvn_delta/svndiff.c (working copy)
@@ -55,10 +55,23 @@ struct encoder_baton {
   apr_pool_t *pool;
 };
 
+/* This is at least as big as the largest size of an integer that
+   encode_int can generate; it is sufficient for creating buffers for
+   it to write into.  This assumes that integers are at most 64 bits,
+   and so 10 bytes (with 7 bits of information each) are sufficient to
+   represent them. */
+#define MAX_ENCODED_INT_LEN 10
+/* This is at least as big as the largest size for a single instruction. */
+#define MAX_INSTRUCTION_LEN (2*MAX_ENCODED_INT_LEN+1)
+/* This is at least as big as the largest possible instructions
+   section: in theory, the instructions could be SVN_DELTA_WINDOW_SIZE
+   1-byte copy-from-source instructions (though this is very unlikely). */
+#define MAX_INSTRUCTION_SECTION_LEN (SVN_DELTA_WINDOW_SIZE*MAX_INSTRUCTION_LEN)
 
 /* Encode VAL into the buffer P using the variable-length svndiff
    integer format.  Return the incremented value of P after the
-   encoded bytes have been written.
+   encoded bytes have been written.  P must point to a buffer of size
+   at least MAX_ENCODED_INT_LEN.
 
    This encoding uses the high bit of each byte as a continuation bit
    and the other seven bits as data bits.  High-order data bits are
@@ -91,6 +104,8 @@ encode_int(char *p, svn_filesize_t val)
       n++;
     }
 
+  assert(n <= MAX_ENCODED_INT_LEN);
+
   /* Encode the remaining bytes; n is always the number of bytes
      coming after the one we're encoding.  */
   while (--n >= 0)
@@ -107,7 +122,7 @@ encode_int(char *p, svn_filesize_t val)
 static void
 append_encoded_int(svn_stringbuf_t *header, svn_filesize_t val)
 {
-  char buf[128], *p;
+  char buf[MAX_ENCODED_INT_LEN], *p;
 
   p = encode_int(buf, val);
   svn_stringbuf_appendbytes(header, buf, p - buf);
@@ -163,7 +178,7 @@ window_handler(svn_txdelta_window_t *window, void
   svn_stringbuf_t *i1 = svn_stringbuf_create("", pool);
   svn_stringbuf_t *header = svn_stringbuf_create("", pool);
   const svn_string_t *newdata;
-  char ibuf[128], *ip;
+  char ibuf[MAX_INSTRUCTION_LEN], *ip;
   const svn_txdelta_op_t *op;
   apr_size_t len;
 
@@ -341,6 +356,8 @@ decode_file_offset(svn_filesize_t *val,
                    const unsigned char *p,
                    const unsigned char *end)
 {
+  if (p + MAX_ENCODED_INT_LEN < end)
+    end = p + MAX_ENCODED_INT_LEN;
   /* Decode bytes until we're done.  */
   *val = 0;
   while (p < end)
@@ -360,6 +377,8 @@ decode_size(apr_size_t *val,
             const unsigned char *p,
             const unsigned char *end)
 {
+  if (p + MAX_ENCODED_INT_LEN < end)
+    end = p + MAX_ENCODED_INT_LEN;
   /* Decode bytes until we're done.  */
   *val = 0;
   while (p < end)
@@ -377,7 +396,7 @@ decode_size(apr_size_t *val,
    data is not compressed.  */
 
 static svn_error_t *
-zlib_decode(svn_stringbuf_t *in, svn_stringbuf_t *out)
+zlib_decode(svn_stringbuf_t *in, svn_stringbuf_t *out, apr_size_t limit)
 {
   apr_size_t len;
   char *oldplace = in->data;
@@ -385,6 +404,13 @@ static svn_error_t *
   /* First thing in the string is the original length.  */
   in->data = (char *)decode_size(&len, (unsigned char *)in->data,
                                  (unsigned char *)in->data+in->len);
+  if (in->data == NULL)
+    return svn_error_create(SVN_ERR_SVNDIFF_INVALID_COMPRESSED_DATA, NULL,
+                            _("Decompression of svndiff data failed: no size"));
+  if (len > limit)
+    return svn_error_create(SVN_ERR_SVNDIFF_INVALID_COMPRESSED_DATA, NULL,
+                            _("Decompression of svndiff data failed: "
+                              "size too large"));
   /* We need to subtract the size of the encoded original length off the
    *      still remaining input length.  */
   in->len -= (in->data - oldplace);
@@ -482,10 +508,10 @@ count_and_verify_instructions(int *ninst,
         return svn_error_createf
           (SVN_ERR_SVNDIFF_INVALID_OPS, NULL,
            _("Invalid diff stream: insn %d cannot be decoded"), n);
-      else if (op.length <= 0)
+      else if (op.length == 0)
         return svn_error_createf
           (SVN_ERR_SVNDIFF_INVALID_OPS, NULL,
-           _("Invalid diff stream: insn %d has non-positive length"), n);
+           _("Invalid diff stream: insn %d has length zero"), n);
       else if (op.length > tview_len - tpos)
         return svn_error_createf
           (SVN_ERR_SVNDIFF_INVALID_OPS, NULL,
@@ -494,7 +520,8 @@ count_and_verify_instructions(int *ninst,
       switch (op.action_code)
         {
         case svn_txdelta_source:
-          if (op.length > sview_len - op.offset)
+          if (op.length > sview_len - op.offset ||
+              op.offset > sview_len)
             return svn_error_createf
               (SVN_ERR_SVNDIFF_INVALID_OPS, NULL,
                _("Invalid diff stream: "
@@ -560,11 +587,11 @@ decode_window(svn_txdelta_window_t *window, svn_fi
 
       instin = svn_stringbuf_ncreate((const char *)data, insend - data, pool);
       instout = svn_stringbuf_create("", pool);
-      SVN_ERR(zlib_decode(instin, instout));
+      SVN_ERR(zlib_decode(instin, instout, MAX_INSTRUCTION_SECTION_LEN));
 
       ndin = svn_stringbuf_ncreate((const char *)insend, newlen, pool);
       ndout = svn_stringbuf_create("", pool);
-      SVN_ERR(zlib_decode(ndin, ndout));
+      SVN_ERR(zlib_decode(ndin, ndout, SVN_DELTA_WINDOW_SIZE));
 
       newlen = ndout->len;
       data = (unsigned char *)instout->data;
@@ -680,6 +707,14 @@ write_handler(void *baton,
       if (p == NULL)
         return SVN_NO_ERROR;
 
+      if (tview_len > SVN_DELTA_WINDOW_SIZE ||
+          sview_len > SVN_DELTA_WINDOW_SIZE ||
+          /* for svndiff1, newlen includes the original length */
+          newlen > SVN_DELTA_WINDOW_SIZE + MAX_ENCODED_INT_LEN ||
+          inslen > MAX_INSTRUCTION_SECTION_LEN)
+        return svn_error_create(SVN_ERR_SVNDIFF_CORRUPT_WINDOW, NULL,
+                                _("Svndiff contains a too-large window"));
+
       /* Check for integer overflow.  */
       if (sview_offset < 0 || inslen + newlen < inslen
           || sview_len + tview_len < sview_len
@@ -836,6 +871,14 @@ read_window_header(svn_stream_t *stream, svn_files
   SVN_ERR(read_one_size(inslen, stream));
   SVN_ERR(read_one_size(newlen, stream));
 
+  if (*tview_len > SVN_DELTA_WINDOW_SIZE ||
+      *sview_len > SVN_DELTA_WINDOW_SIZE ||
+      /* for svndiff1, newlen includes the original length */
+      *newlen > SVN_DELTA_WINDOW_SIZE + MAX_ENCODED_INT_LEN ||
+      *inslen > MAX_INSTRUCTION_SECTION_LEN)
+    return svn_error_create(SVN_ERR_SVNDIFF_CORRUPT_WINDOW, NULL,
+                            _("Svndiff contains a too-large window"));
+
   /* Check for integer overflow.  */
   if (*sview_offset < 0 || *inslen + *newlen < *inslen
       || *sview_len + *tview_len < *sview_len
Index: subversion/libsvn_delta/text_delta.c
===================================================================
--- subversion/libsvn_delta/text_delta.c  (revision 38498)
+++ subversion/libsvn_delta/text_delta.c  (working copy)
@@ -498,7 +498,7 @@ svn_txdelta_target_push(svn_txdelta_window_handler
 /* Functions for applying deltas.  */
 
 /* Ensure that BUF has enough space for VIEW_LEN bytes.  */
-static APR_INLINE void
+static APR_INLINE svn_error_t *
 size_buffer(char **buf, apr_size_t *buf_size,
             apr_size_t view_len, apr_pool_t *pool)
 {
@@ -507,8 +507,13 @@ size_buffer(char **buf, apr_size_t *buf_size,
       *buf_size *= 2;
       if (*buf_size < view_len)
         *buf_size = view_len;
+      if (APR_ALIGN_DEFAULT(*buf_size) < *buf_size)
+        return svn_error_create(SVN_ERR_SVNDIFF_INVALID_OPS, NULL,
+                                "Diff stream resulted in invalid buffer size.");
       *buf = apr_palloc(pool, *buf_size);
     }
+
+  return SVN_NO_ERROR;
 }
 
 
@@ -609,7 +614,7 @@ apply_window(svn_txdelta_window_t *window, void *b
                  >= ab->sbuf_offset + ab->sbuf_len)));
 
   /* Make sure there's enough room in the target buffer.  */
-  size_buffer(&ab->tbuf, &ab->tbuf_size, window->tview_len, ab->pool);
+  SVN_ERR(size_buffer(&ab->tbuf, &ab->tbuf_size, window->tview_len, ab->pool));
 
   /* Prepare the source buffer for reading from the input stream.  */
   if (window->sview_offset != ab->sbuf_offset
@@ -618,7 +623,8 @@ apply_window(svn_txdelta_window_t *window, void *b
       char *old_sbuf = ab->sbuf;
 
       /* Make sure there's enough room.  */
-      size_buffer(&ab->sbuf, &ab->sbuf_size, window->sview_len, ab->pool);
+      SVN_ERR(size_buffer(&ab->sbuf, &ab->sbuf_size, window->sview_len,
+              ab->pool));
 
       /* If the existing view overlaps with the new view, copy the
        * overlap to the beginning of the new buffer.  */
]]]
_______________________________________________
Vendor Security mailing list
Vendor Security@lst.de
https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec

----- End forwarded message -----

-- 
Bye,
     Thomas
-- 
 Thomas Biege <thomas@suse.de>, SUSE LINUX, Security Support & Auditing
 SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
-- 
           Hamming's Motto:
           The purpose of computing is insight, not numbers.
                                -- Richard W. Hamming