Author: svn-role
Date: Fri Apr 13 04:01:24 2012
New Revision: 1325606
URL: http://svn.apache.org/viewvc?rev=1325606&view=rev
Log:
Merge r1311702 from trunk:
* r1311702
Prevent out-of-bounds array access during 'svn diff' arguments processing.
Justification:
'svn diff --old path/to/.svn --new path/to/.svn' segfaults.
Votes:
+1: stsp, hwright, philip
Modified:
subversion/branches/1.7.x/ (props changed)
subversion/branches/1.7.x/STATUS
subversion/branches/1.7.x/subversion/svn/diff-cmd.c
Propchange: subversion/branches/1.7.x/
------------------------------------------------------------------------------
Merged /subversion/trunk:r1311702
Modified: subversion/branches/1.7.x/STATUS
URL:
http://svn.apache.org/viewvc/subversion/branches/1.7.x/STATUS?rev=1325606&r1=1325605&r2=1325606&view=diff
==============================================================================
--- subversion/branches/1.7.x/STATUS (original)
+++ subversion/branches/1.7.x/STATUS Fri Apr 13 04:01:24 2012
@@ -143,10 +143,3 @@ Veto-blocked changes:
Approved changes:
=================
-
- * r1311702
- Prevent out-of-bounds array access during 'svn diff' arguments processing.
- Justification:
- 'svn diff --old path/to/.svn --new path/to/.svn' segfaults.
- Votes:
- +1: stsp, hwright, philip
Modified: subversion/branches/1.7.x/subversion/svn/diff-cmd.c
URL:
http://svn.apache.org/viewvc/subversion/branches/1.7.x/subversion/svn/diff-cmd.c?rev=1325606&r1=1325605&r2=1325606&view=diff
==============================================================================
--- subversion/branches/1.7.x/subversion/svn/diff-cmd.c (original)
+++ subversion/branches/1.7.x/subversion/svn/diff-cmd.c Fri Apr 13 04:01:24 2012
@@ -247,6 +247,12 @@ svn_cl__diff(apr_getopt_t *os,
SVN_ERR(svn_cl__args_to_target_array_print_reserved(&tmp2, os, tmp,
ctx, FALSE, pool));
+
+ /* Check if either or both targets were skipped (e.g. because they
+ * were .svn directories). */
+ if (tmp2->nelts < 2)
+ return svn_error_create(SVN_ERR_CL_INSUFFICIENT_ARGS, NULL, NULL);
+
SVN_ERR(svn_opt_parse_path(&old_rev, &old_target,
APR_ARRAY_IDX(tmp2, 0, const char *),
pool));
