goobspatch: Improve sanity checks for invalid patches.

chrome/installer/mac/third_party/bsdiff/goobspatch.c

 /*-
  * Copyright 2003-2005 Colin Percival
  * All rights reserved
  *
  * Redistribution and use in source and binary forms, with or without
- * modification, are permitted providing that the following conditions 
+ * modification, are permitted providing that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ skipping 446 matching lines @@
 
         oldpos=0;newpos=0;
         while(newpos<newsize) {
                 /* Read control data */
                 for(i=0;i<=2;i++) {
                         cfread(&cf, buf, 8);
                         ctrl[i]=offtin(buf);
                 };
 
                 /* Sanity-check */
+                if((ctrl[0]<0) || (ctrl[1]<0))
+                        errx(1,"corrupt patch (diff): negative chunk size");
+
+                /* Sanity-check */
                 if(newpos+ctrl[0]>newsize)
                         errx(1,"corrupt patch (diff): overrun");
 
                 /* Read diff string */
                 cfread(&df, new + newpos, ctrl[0]);
 
                 /* Add old data to diff string */
                 for(i=0;i<ctrl[0];i++)
                         if((oldpos+i>=0) && (oldpos+i<oldsize))
                                 new[newpos+i]+=old[oldpos+i];
@@ skipping 30 matching lines @@
         /* Write the new file */
         if(((fd=open(argv[2],O_CREAT|O_TRUNC|O_WRONLY,0644))<0) ||
                 (write(fd,new,newsize)!=newsize) || (close(fd)==-1))
                 err(1,"open/write/close(%s)",argv[2]);
 
         free(new);
         free(old);
 
         return 0;
 }