From c94cceea9c2262c5b2ad5f215bb9a8ae48b02764 Mon Sep 17 00:00:00 2001 From: Dimitry Andric Date: Fri, 29 Apr 2016 19:16:59 +0000 Subject: Vendor import of subversion-1.9.4. --- subversion/libsvn_ra_svn/marshal.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'subversion/libsvn_ra_svn/marshal.c') diff --git a/subversion/libsvn_ra_svn/marshal.c b/subversion/libsvn_ra_svn/marshal.c index 55e3c1f1bb6b..0778269fa404 100644 --- a/subversion/libsvn_ra_svn/marshal.c +++ b/subversion/libsvn_ra_svn/marshal.c @@ -944,6 +944,7 @@ static svn_error_t *read_string(svn_ra_svn_conn_t *conn, apr_pool_t *pool, apr_size_t len = (apr_size_t)len64; apr_size_t readbuf_len; char *dest; + apr_size_t buflen; /* We can't store strings longer than the maximum size of apr_size_t, * so check for wrapping */ @@ -951,8 +952,9 @@ static svn_error_t *read_string(svn_ra_svn_conn_t *conn, apr_pool_t *pool, return svn_error_create(SVN_ERR_RA_SVN_MALFORMED_DATA, NULL, _("String length larger than maximum")); + buflen = conn->read_end - conn->read_ptr; /* Shorter strings can be copied directly from the read buffer. */ - if (conn->read_ptr + len <= conn->read_end) + if (len <= buflen) { item->kind = SVN_RA_SVN_STRING; item->u.string = svn_string_ncreate(conn->read_ptr, len, pool); -- cgit v1.2.3