commit b5c076278bbb7205a9828d2ac2da41999fff4a14
from: Omar Polo <op@omarpolo.com>
via: Thomas Adam <thomas@xteddy.org>
date: Thu Aug 18 20:04:48 2022 UTC

fix overflow in blame callback

spotted by noticing gotwebd crashing on some blame requests.

Diff from stsp@ with a fix from tracey@, I'm committing it only because
he is short on time.

ok stsp@

commit - 720c2b0511f6dbff9e2bf529e474143ca8617731
commit + b5c076278bbb7205a9828d2ac2da41999fff4a14
blob - ad3725943dcaf0bdbfe390eafdf41e8b99747147
blob + c608eb8d96bbda11a3a8eb5c9846e403ca0b71f9
--- got/got.c
+++ got/got.c
@@ -5366,7 +5366,7 @@ blame_cb(void *arg, int nlines, int lineno,
 		goto done;
 	}
 
-	while (bline->annotated) {
+	while (a->lineno_cur <= a->nlines && bline->annotated) {
 		char *smallerthan, *at, *nl, *committer;
 		size_t len;
 
blob - da9f041cbfef9184c60aa257ec187e714ee04860
blob + 9d0bbf58f683adb056c946f2084ab2897e4509f3
--- gotweb/gotweb.c
+++ gotweb/gotweb.c
@@ -3959,7 +3959,7 @@ gw_blame_cb(void *arg, int nlines, int lineno,
 		goto done;
 	}
 
-	while (bline->annotated) {
+	while (a->lineno_cur <= a->nlines && bline->annotated) {
 		char *smallerthan, *at, *nl, *committer;
 		char *href_diff = NULL;
 		size_t len;
blob - 3b0a06ca580864bb71c6b67aba40d7ef49b54c5c
blob + c87753eb142bed716b3f35a8c0220ffda1b98a05
--- gotwebd/got_operations.c
+++ gotwebd/got_operations.c
@@ -1334,7 +1334,7 @@ got_gotweb_blame_cb(void *arg, int nlines, int lineno,
 		goto done;
 	}
 
-	while (bline->annotated) {
+	while (a->lineno_cur <= a->nlines && bline->annotated) {
 		int out_buff_size = 100;
 		char *smallerthan, *at, *nl, *committer;
 		char out_buff[out_buff_size];