svn commit: r1714380 - /subversion/trunk/subversion/libsvn_subr/sorts.c

[st...@apache.org]

Author: stefan2
Date: Sat Nov 14 21:17:40 2015
New Revision: 1714380

URL: http://svn.apache.org/viewvc?rev=1714380&view=rev
Log:
Fix svn_sort__array_delete for very large arrays.

The only way to trigger this in our current code is to have
mergeinfo with more than 1G ranges per path.

* subversion/libsvn_subr/sorts.c
  (svn_sort__array_delete): Use the right overflow check.

Modified:
    subversion/trunk/subversion/libsvn_subr/sorts.c

Modified: subversion/trunk/subversion/libsvn_subr/sorts.c
URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/libsvn_subr/sorts.c?rev=1714380&r1=1714379&r2=1714380&view=diff
==============================================================================
--- subversion/trunk/subversion/libsvn_subr/sorts.c (original)
+++ subversion/trunk/subversion/libsvn_subr/sorts.c Sat Nov 14 21:17:40 2015
@@ -333,7 +333,7 @@ svn_sort__array_delete(apr_array_header_
   if (delete_index >= 0
       && delete_index < arr->nelts
       && elements_to_delete > 0
-      && (elements_to_delete + delete_index) <= arr->nelts)
+      && (arr->nelts - delete_index) >= elements_to_delete)
     {
       /* If we are not deleting a block of elements that extends to the end
          of the array, then we need to move the remaining elements to keep