Fix security bug in parsing of the svn protocol.  We were allowing the sender to request that we allocate an arbitrary amount of memory.  This could allow the sender to denial of service attack the remote side by    using up large amounts of memory or cause a heap overflow due to the   integer holding the string length wrapping.
Fix security bug in parsing of the svn protocol.  We were allowing the
sender to request that we allocate an arbitrary amount of memory.  This
could allow the sender to denial of service attack the remote side by   
using up large amounts of memory or cause a heap overflow due to the  
integer holding the string length wrapping.

Bug found by: ned <nd@felinemenace.org>

This issue is known as CAN-2004-0413 at http://cve.mitre.org/

* subversion/libsvn_ra_svn/marshal.c
  (read_string): New function that buffers strings into svn_stringbuf_t.
  (read_item): When reading integers check for wrapping.
    Use the new read_string() function to read in strings.
    Remove a spurious return that accepted illegal syntax.



git-svn-id: f8a4e5e023278da1e04e203c7fe051e3c4285d88@850020 13f79535-47bb-0310-9956-ffa450edef68

YueLinHo/Subversion,YueLinHo/Subversion,wbond/subversion,wbond/subversion,YueLinHo/Subversion,wbond/subversion,YueLinHo/Subversion,YueLinHo/Subversion,wbond/subversion,wbond/subversion,YueLinHo/Subversion,wbond/subversion,YueLinHo/Subversion,YueLinHo/Subversion,wbond/subversion