Merge the 1.8.x-issue4658 branch:

 * r1766352, r1766590
   Fix issue #4658: Can't reconstruct fulltext from DELTA against PLAIN in FSFS
   Justification:
     Prevents access to committed data.  This is as close to a corruption one
     could get without actually corrupting anything.  User reported issue.
   Branch:
     ^/subversion/branches/1.8.x-issue4658
   Notes:
     r1766352 contains the actual fix.
     r1766590 adds a test case for it.
   Votes:
     +1: stefan2, stsp, brane
     +0: rhuijben


git-svn-id: https://svn.apache.org/repos/asf/subversion/branches/1.8.x@1770613 13f79535-47bb-0310-9956-ffa450edef68
diff --git a/STATUS b/STATUS
index 0597214..210eb9b 100644
--- a/STATUS
+++ b/STATUS
@@ -67,17 +67,3 @@
 
         This is happily not exactly a bug because the '< 0' branch will
         catch these cases, but it's really messy ...]]]
-
- * r1766352, r1766590
-   Fix issue #4658: Can't reconstruct fulltext from DELTA against PLAIN in FSFS
-   Justification:
-     Prevents access to committed data.  This is as close to a corruption one
-     could get without actually corrupting anything.  User reported issue.
-   Branch:
-     ^/subversion/branches/1.8.x-issue4658
-   Notes:
-     r1766352 contains the actual fix.
-     r1766590 adds a test case for it.
-   Votes:
-     +1: stefan2, stsp, brane
-     +0: rhuijben
diff --git a/subversion/libsvn_fs_fs/fs_fs.c b/subversion/libsvn_fs_fs/fs_fs.c
index 6a61b17..4c2f62b 100644
--- a/subversion/libsvn_fs_fs/fs_fs.c
+++ b/subversion/libsvn_fs_fs/fs_fs.c
@@ -5072,6 +5072,17 @@
   return SVN_NO_ERROR;
 }
 
+/* Skip SIZE bytes from the PLAIN representation RS. */
+static svn_error_t *
+skip_plain_window(struct rep_state *rs,
+                  apr_size_t size)
+{
+  /* Update RS. */
+  rs->off += (apr_off_t)size;
+
+  return SVN_NO_ERROR;
+}
+
 /* Get the undeltified window that is a result of combining all deltas
    from the current desired representation identified in *RB with its
    base representation.  Store the window in *RESULT. */
@@ -5120,9 +5131,17 @@
          Also note that we may have short-cut reading the delta chain --
          in which case SRC_OPS is 0 and it might not be a PLAIN rep. */
       source = buf;
-      if (source == NULL && rb->src_state != NULL && window->src_ops)
-        SVN_ERR(read_plain_window(&source, rb->src_state, window->sview_len,
-                                  pool));
+      if (source == NULL && rb->src_state != NULL)
+        {
+          /* Even if we don't need the source rep now, we still must keep
+           * its read offset in sync with what we might need for the next
+           * window. */
+          if (window->src_ops)
+            SVN_ERR(read_plain_window(&source, rb->src_state,
+                                      window->sview_len, pool));
+          else
+            SVN_ERR(skip_plain_window(rb->src_state, window->sview_len));
+        }
 
       /* Combine this window with the current one. */
       new_pool = svn_pool_create(rb->pool);
diff --git a/subversion/tests/libsvn_fs_fs/fs-pack-test.c b/subversion/tests/libsvn_fs_fs/fs-pack-test.c
index abfc657..0b77792 100644
--- a/subversion/tests/libsvn_fs_fs/fs-pack-test.c
+++ b/subversion/tests/libsvn_fs_fs/fs-pack-test.c
@@ -1142,6 +1142,82 @@
 #undef REPO_NAME
 
 /* ------------------------------------------------------------------------ */
+
+#define REPO_NAME "test-repo-large_delta_against_plain"
+
+static svn_error_t *
+large_delta_against_plain(const svn_test_opts_t *opts,
+                          apr_pool_t *pool)
+{
+  svn_fs_t *fs;
+  fs_fs_data_t *ffd;
+  svn_fs_txn_t *txn;
+  svn_fs_root_t *root;
+  svn_revnum_t rev;
+  svn_stringbuf_t *prop_value;
+  svn_string_t *prop_read;
+  int i;
+  apr_hash_t *fs_config;
+
+  if (strcmp(opts->fs_type, "fsfs") != 0)
+    return svn_error_create(SVN_ERR_TEST_SKIPPED, NULL, NULL);
+
+  /* Create a repo that and explicitly enable rep sharing. */
+  SVN_ERR(svn_test__create_fs(&fs, REPO_NAME, opts, pool));
+  ffd = fs->fsap_data;
+
+  /* Make sure all props are stored as PLAIN reps. */
+  ffd->deltify_properties = FALSE;
+
+  /* Construct a property larger than 2 txdelta windows. */
+  prop_value = svn_stringbuf_create("prop", pool);
+  while (prop_value->len <= 2 * 102400)
+    svn_stringbuf_appendstr(prop_value, prop_value);
+
+  /* Revision 1: create a property rep. */
+  SVN_ERR(svn_fs_begin_txn(&txn, fs, 0, pool));
+  SVN_ERR(svn_fs_txn_root(&root, txn, pool));
+  SVN_ERR(svn_fs_change_node_prop(root, "/", "p",
+                                  svn_string_create(prop_value->data, pool),
+                                  pool));
+  SVN_ERR(svn_fs_commit_txn(NULL, &rev, txn, pool));
+
+  /* Now, store them as DELTA reps. */
+  ffd->deltify_properties = TRUE;
+
+  /* Construct a property larger than 2 txdelta windows, distinct from the
+   * previous one but with a matching "tail". */
+  prop_value = svn_stringbuf_create("blob", pool);
+  while (prop_value->len <= 2 * 102400)
+    svn_stringbuf_appendstr(prop_value, prop_value);
+  for (i = 0; i < 100; ++i)
+    svn_stringbuf_appendcstr(prop_value, "prop");
+
+  /* Revision 2: modify the property. */
+  SVN_ERR(svn_fs_begin_txn(&txn, fs, 1, pool));
+  SVN_ERR(svn_fs_txn_root(&root, txn, pool));
+  SVN_ERR(svn_fs_change_node_prop(root, "/", "p",
+                                  svn_string_create(prop_value->data, pool),
+                                  pool));
+  SVN_ERR(svn_fs_commit_txn(NULL, &rev, txn, pool));
+
+  /* Reconstructing the property deltified must work.  To make sure we
+   * actually read from disk, use a new FS instance with disjoint caches. */
+  fs_config = apr_hash_make(pool);
+  svn_hash_sets(fs_config, SVN_FS_CONFIG_FSFS_CACHE_NS,
+                           svn_uuid_generate(pool));
+  SVN_ERR(svn_fs_open(&fs, REPO_NAME, fs_config, pool));
+
+  SVN_ERR(svn_fs_revision_root(&root, fs, rev, pool));
+  SVN_ERR(svn_fs_node_prop(&prop_read, root, "/", "p", pool));
+  SVN_TEST_STRING_ASSERT(prop_read->data, prop_value->data);
+
+  return SVN_NO_ERROR;
+}
+
+#undef REPO_NAME
+
+/* ------------------------------------------------------------------------ */
 
 /* The test table.  */
 
@@ -1174,5 +1250,7 @@
                        "delta chains starting with PLAIN, issue #4577"),
     SVN_TEST_OPTS_PASS(plain_0_length,
                        "file with 0 expanded-length, issue #4554"),
+    SVN_TEST_OPTS_PASS(large_delta_against_plain,
+                       "large deltas against PLAIN, issue #4658"),
     SVN_TEST_NULL
   };