fix(patch)!: stop parsing at garbage after hunk satisfied

src/patch/error.rs

@@ -107,6 +107,9 @@ pub(crate) enum ParsePatchErrorKind {
 
     /// Missing newline at end of line.
     MissingNewline,
+
+    /// Orphaned hunk header found after trailing content.
+    OrphanedHunkHeader,
 }
 
 impl fmt::Display for ParsePatchErrorKind {
@@ -132,6 +135,7 @@ impl fmt::Display for ParsePatchErrorKind {
             Self::UnexpectedNoNewlineMarker => "unexpected 'No newline at end of file' line",
             Self::UnexpectedHunkLine => "unexpected line in hunk body",
             Self::MissingNewline => "missing newline",
+            Self::OrphanedHunkHeader => "orphaned hunk header after trailing content",
         };
         write!(f, "{msg}")
     }

src/patch/mod.rs

@@ -16,6 +16,30 @@ use crate::utils::{byte_needs_quoting, fmt_escaped_byte, write_escaped_byte};
 const NO_NEWLINE_AT_EOF: &str = "\\ No newline at end of file";
 
 /// Representation of all the differences between two files
+///
+/// # Parsing modes
+///
+/// `Patch` provides two parsing modes with different strictness levels,
+/// modeled after the behavior of GNU patch and `git apply`:
+///
+/// | Scenario                          | GNU patch   | git apply | [`from_str`] | [`from_str_strict`] |
+/// |-----------------------------------|-------------|-----------|--------------|---------------------|
+/// | Junk after all hunks are complete | Ignores     | Ignores   | Ignores      | Ignores             |
+/// | Junk between hunks                | Ignores[^1] | Errors    | Ignores[^1]  | Errors              |
+///
+/// [^1]: "Ignores" here means silently stopping at the junk.
+///     Only hunks before it are parsed; later hunks are dropped.
+///
+/// [`from_str`] and [`from_bytes`] follow GNU patch behavior,
+/// silently ignoring non-patch content after a hunk's line counts are satisfied.
+///
+/// [`from_str_strict`] and [`from_bytes_strict`] follow `git apply` behavior,
+/// additionally rejecting orphaned hunk headers hidden behind trailing content.
+///
+/// [`from_str`]: Patch::from_str
+/// [`from_bytes`]: Patch::from_bytes
+/// [`from_str_strict`]: Patch::from_str_strict
+/// [`from_bytes_strict`]: Patch::from_bytes_strict
 #[derive(PartialEq, Eq)]
 pub struct Patch<'a, T: ToOwned + ?Sized> {
     // TODO GNU patch is able to parse patches without filename headers.
@@ -108,13 +132,31 @@ impl<'a> Patch<'a, str> {
     pub fn from_str(s: &'a str) -> Result<Patch<'a, str>, ParsePatchError> {
         parse::parse(s)
     }
+
+    /// Parse a `Patch` from a string in strict mode
+    ///
+    /// Unlike [`Patch::from_str`],
+    /// this rejects orphaned hunk headers hidden after trailing content,
+    /// matching `git apply` behavior.
+    pub fn from_str_strict(s: &'a str) -> Result<Patch<'a, str>, ParsePatchError> {
+        parse::parse_strict(s)
+    }
 }
 
 impl<'a> Patch<'a, [u8]> {
     /// Parse a `Patch` from bytes
     pub fn from_bytes(s: &'a [u8]) -> Result<Patch<'a, [u8]>, ParsePatchError> {
         parse::parse_bytes(s)
     }
+
+    /// Parse a `Patch` from bytes in strict mode
+    ///
+    /// Unlike [`Patch::from_bytes`],
+    /// this rejects orphaned hunk headers hidden after trailing content,
+    /// matching `git apply` behavior.
+    pub fn from_bytes_strict(s: &'a [u8]) -> Result<Patch<'a, [u8]>, ParsePatchError> {
+        parse::parse_bytes_strict(s)
+    }
 }
 
 impl<T: ToOwned + ?Sized> Clone for Patch<'_, T> {

src/patch/parse.rs

@@ -65,6 +65,19 @@ pub fn parse(input: &str) -> Result<Patch<'_, str>> {
     ))
 }
 
+pub fn parse_strict(input: &str) -> Result<Patch<'_, str>> {
+    let mut parser = Parser::new(input);
+    let header = patch_header(&mut parser)?;
+    let hunks = hunks(&mut parser)?;
+    reject_orphaned_hunk_headers(&mut parser)?;
+
+    Ok(Patch::new(
+        header.0.map(convert_cow_to_str),
+        header.1.map(convert_cow_to_str),
+        hunks,
+    ))
+}
+
 pub fn parse_bytes(input: &[u8]) -> Result<Patch<'_, [u8]>> {
     let mut parser = Parser::new(input);
     let header = patch_header(&mut parser)?;
@@ -73,6 +86,15 @@ pub fn parse_bytes(input: &[u8]) -> Result<Patch<'_, [u8]>> {
     Ok(Patch::new(header.0, header.1, hunks))
 }
 
+pub fn parse_bytes_strict(input: &[u8]) -> Result<Patch<'_, [u8]>> {
+    let mut parser = Parser::new(input);
+    let header = patch_header(&mut parser)?;
+    let hunks = hunks(&mut parser)?;
+    reject_orphaned_hunk_headers(&mut parser)?;
+
+    Ok(Patch::new(header.0, header.1, hunks))
+}
+
 // This is only used when the type originated as a utf8 string
 fn convert_cow_to_str(cow: Cow<'_, [u8]>) -> Cow<'_, str> {
     match cow {
@@ -154,9 +176,26 @@ fn verify_hunks_in_order<T: ?Sized>(hunks: &[Hunk<'_, T>]) -> bool {
     true
 }
 
+/// Scans remaining lines for orphaned `@@ ` hunk headers.
+///
+/// In strict mode (git-apply behavior), trailing junk is allowed but
+/// an `@@ ` line hiding behind that junk indicates a lost hunk.
+fn reject_orphaned_hunk_headers<T: Text + ?Sized>(parser: &mut Parser<'_, T>) -> Result<()> {
+    while let Some(line) = parser.peek() {
+        if line.starts_with("@@ ") {
+            return Err(parser.error(ParsePatchErrorKind::OrphanedHunkHeader));
+        }
+        parser.next()?;
+    }
+    Ok(())
+}
+
 fn hunks<'a, T: Text + ?Sized>(parser: &mut Parser<'a, T>) -> Result<Vec<Hunk<'a, T>>> {
     let mut hunks = Vec::new();
-    while parser.peek().is_some() {
+    // Following GNU patch behavior: stop at non-@@ content.
+    // Any trailing content (including hidden @@ headers) is silently ignored.
+    // This is more permissive than git apply, which errors on junk between hunks.
+    while parser.peek().is_some_and(|line| line.starts_with("@@ ")) {
         hunks.push(hunk(parser)?);
     }
 
@@ -173,13 +212,7 @@ fn hunk<'a, T: Text + ?Sized>(parser: &mut Parser<'a, T>) -> Result<Hunk<'a, T>>
     let header_line = parser.next()?;
     let (range1, range2, function_context) =
         hunk_header(header_line).map_err(|e| parser.error_at(e.kind, hunk_start))?;
-    let lines = hunk_lines(parser)?;
-
-    // check counts of lines to see if they match the ranges in the hunk header
-    let (len1, len2) = super::hunk_lines_count(&lines);
-    if len1 != range1.len || len2 != range2.len {
-        return Err(parser.error_at(ParsePatchErrorKind::HunkMismatch, hunk_start));
-    }
+    let lines = hunk_lines(parser, range1.len, range2.len, hunk_start)?;
 
     Ok(Hunk::new(range1, range2, function_context, lines))
 }
@@ -223,36 +256,61 @@ fn range<T: Text + ?Sized>(s: &T) -> Result<HunkRange> {
     Ok(HunkRange::new(start, len))
 }
 
-fn hunk_lines<'a, T: Text + ?Sized>(parser: &mut Parser<'a, T>) -> Result<Vec<Line<'a, T>>> {
+fn hunk_lines<'a, T: Text + ?Sized>(
+    parser: &mut Parser<'a, T>,
+    expected_old: usize,
+    expected_new: usize,
+    hunk_start: usize,
+) -> Result<Vec<Line<'a, T>>> {
     let mut lines: Vec<Line<'a, T>> = Vec::new();
     let mut no_newline_context = false;
     let mut no_newline_delete = false;
     let mut no_newline_insert = false;
 
+    let mut old_count = 0;
+    let mut new_count = 0;
+
     while let Some(line) = parser.peek() {
+        let hunk_complete = old_count >= expected_old && new_count >= expected_new;
+
         let line = if line.starts_with("@") {
             break;
         } else if no_newline_context {
+            if hunk_complete {
+                break;
+            }
             return Err(parser.error(ParsePatchErrorKind::ExpectedEndOfHunk));
         } else if let Some(line) = line.strip_prefix(" ") {
+            if hunk_complete {
+                break;
+            }
             Line::Context(line)
         } else if line.starts_with("\n") {
+            if hunk_complete {
+                break;
+            }
             Line::Context(*line)
         } else if let Some(line) = line.strip_prefix("-") {
             if no_newline_delete {
                 return Err(parser.error(ParsePatchErrorKind::TooManyDeletedLines));
             }
+            if hunk_complete {
+                break;
+            }
             Line::Delete(line)
         } else if let Some(line) = line.strip_prefix("+") {
             if no_newline_insert {
                 return Err(parser.error(ParsePatchErrorKind::TooManyInsertedLines));
             }
+            if hunk_complete {
+                break;
+            }
             Line::Insert(line)
         } else if line.starts_with(NO_NEWLINE_AT_EOF) {
             let last_line = lines
                 .pop()
                 .ok_or_else(|| parser.error(ParsePatchErrorKind::UnexpectedNoNewlineMarker))?;
-            match last_line {
+            let modified = match last_line {
                 Line::Context(line) => {
                     no_newline_context = true;
                     Line::Context(strip_newline(line)?)
@@ -265,15 +323,38 @@ fn hunk_lines<'a, T: Text + ?Sized>(parser: &mut Parser<'a, T>) -> Result<Vec<Li
                     no_newline_insert = true;
                     Line::Insert(strip_newline(line)?)
                 }
-            }
+            };
+            lines.push(modified);
+            parser.next()?;
+            continue;
         } else {
+            if hunk_complete {
+                break;
+            }
             return Err(parser.error(ParsePatchErrorKind::UnexpectedHunkLine));
         };
 
+        match &line {
+            Line::Context(_) => {
+                old_count += 1;
+                new_count += 1;
+            }
+            Line::Delete(_) => {
+                old_count += 1;
+            }
+            Line::Insert(_) => {
+                new_count += 1;
+            }
+        }
+
         lines.push(line);
         parser.next()?;
     }
 
+    if old_count != expected_old || new_count != expected_new {
+        return Err(parser.error_at(ParsePatchErrorKind::HunkMismatch, hunk_start));
+    }
+
     Ok(lines)
 }