From 8be207723a26264124536760d079a00cc56b1077 Mon Sep 17 00:00:00 2001
From: pfg <pfg@FreeBSD.org>
Date: Sun, 15 Jun 2014 03:54:23 +0000
Subject: [PATCH] patch: unsign the line length to avoid overflows.

Patch(1) uses a short int for the line length, which is usually
sufficient for regular diffs, but makes no effort to signal
when there is an overflow.

Change the line length to an unsigned short int to better use
the fact that a length is never negative.  The change is loosely
inspired on a related change in DragonFly, but we avoid spending
more memory than necessary.

While here adjust the messages to be clearer on what is happening.

MFC after:	1 week
---
 usr.bin/patch/patch.c | 14 +++++++++-----
 usr.bin/patch/pch.c   | 10 +++++-----
 usr.bin/patch/pch.h   |  2 +-
 3 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/usr.bin/patch/patch.c b/usr.bin/patch/patch.c
index 1743678626c5..7a5328418118 100644
--- a/usr.bin/patch/patch.c
+++ b/usr.bin/patch/patch.c
@@ -742,14 +742,18 @@ abort_context_hunk(void)
 static void
 rej_line(int ch, LINENUM i)
 {
-	size_t len;
+	unsigned short len;
 	const char *line = pfetch(i);
 
-	len = strlen(line);
+	len = strnlen(line, USHRT_MAX);
 
 	fprintf(rejfp, "%c%s", ch, line);
-	if (len == 0 || line[len-1] != '\n')
-		fprintf(rejfp, "\n\\ No newline at end of file\n");
+	if (len == 0 || line[len-1] != '\n') {
+		if (len >= USHRT_MAX)
+			fprintf(rejfp, "\n\\ Line too long\n");
+		else
+			fprintf(rejfp, "\n\\ No newline at end of line\n");
+	}
 }
 
 static void
@@ -1016,7 +1020,7 @@ patch_match(LINENUM base, LINENUM offset, LINENUM fuzz)
 	LINENUM		pat_lines = pch_ptrn_lines() - fuzz;
 	const char	*ilineptr;
 	const char	*plineptr;
-	short		plinelen;
+	unsigned short	plinelen;
 
 	for (iline = base + offset + fuzz; pline <= pat_lines; pline++, iline++) {
 		ilineptr = ifetch(iline, offset >= 0);
diff --git a/usr.bin/patch/pch.c b/usr.bin/patch/pch.c
index 691add1efe26..d9c4b3d0c4b6 100644
--- a/usr.bin/patch/pch.c
+++ b/usr.bin/patch/pch.c
@@ -56,7 +56,7 @@ static LINENUM	p_max;		/* max allowed value of p_end */
 static LINENUM	p_context = 3;	/* # of context lines */
 static LINENUM	p_input_line = 0;	/* current line # from patch file */
 static char	**p_line = NULL;/* the text of the hunk */
-static short	*p_len = NULL;	/* length of each line */
+static unsigned short	*p_len = NULL; /* length of each line */
 static char	*p_char = NULL;	/* +, -, and ! */
 static int	hunkmax = INITHUNKMAX;	/* size of above arrays to begin with */
 static int	p_indent;	/* indent to patch */
@@ -134,7 +134,7 @@ set_hunkmax(void)
 	if (p_line == NULL)
 		p_line = malloc(hunkmax * sizeof(char *));
 	if (p_len == NULL)
-		p_len = malloc(hunkmax * sizeof(short));
+		p_len = malloc(hunkmax * sizeof(unsigned short));
 	if (p_char == NULL)
 		p_char = malloc(hunkmax * sizeof(char));
 }
@@ -151,7 +151,7 @@ grow_hunkmax(void)
 		fatal("Internal memory allocation error\n");
 
 	p_line = reallocf(p_line, new_hunkmax * sizeof(char *));
-	p_len = reallocf(p_len, new_hunkmax * sizeof(short));
+	p_len = reallocf(p_len, new_hunkmax * sizeof(unsigned short));
 	p_char = reallocf(p_char, new_hunkmax * sizeof(char));
 
 	if (p_line != NULL && p_len != NULL && p_char != NULL) {
@@ -1201,7 +1201,7 @@ bool
 pch_swap(void)
 {
 	char	**tp_line;	/* the text of the hunk */
-	short	*tp_len;	/* length of each line */
+	unsigned short	*tp_len;/* length of each line */
 	char	*tp_char;	/* +, -, and ! */
 	LINENUM	i;
 	LINENUM	n;
@@ -1358,7 +1358,7 @@ pch_context(void)
 /*
  * Return the length of a particular patch line.
  */
-short
+unsigned short
 pch_line_len(LINENUM line)
 {
 	return p_len[line];
diff --git a/usr.bin/patch/pch.h b/usr.bin/patch/pch.h
index e60cc8694e9d..da7a08d4008b 100644
--- a/usr.bin/patch/pch.h
+++ b/usr.bin/patch/pch.h
@@ -44,7 +44,7 @@ bool		there_is_another_patch(void);
 bool		another_hunk(void);
 bool		pch_swap(void);
 char		*pfetch(LINENUM);
-short		pch_line_len(LINENUM);
+unsigned short	pch_line_len(LINENUM);
 LINENUM		pch_first(void);
 LINENUM		pch_ptrn_lines(void);
 LINENUM		pch_newfirst(void);