Mercurial > hg > nginx
diff src/http/ngx_http_parse.c @ 6014:e370c5fdf4c8
Overflow detection in ngx_http_parse_chunked().
author | Ruslan Ermilov <ru@nginx.com> |
---|---|
date | Tue, 17 Mar 2015 00:26:27 +0300 |
parents | c5ec6944de98 |
children | 302ff40c9bc9 |
line wrap: on
line diff
--- a/src/http/ngx_http_parse.c Tue Mar 17 00:26:24 2015 +0300 +++ b/src/http/ngx_http_parse.c Tue Mar 17 00:26:27 2015 +0300 @@ -2155,6 +2155,10 @@ goto invalid; case sw_chunk_size: + if (ctx->size > NGX_MAX_OFF_T_VALUE / 16) { + goto invalid; + } + if (ch >= '0' && ch <= '9') { ctx->size = ctx->size * 16 + (ch - '0'); break; @@ -2304,6 +2308,10 @@ ctx->state = state; b->pos = pos; + if (ctx->size > NGX_MAX_OFF_T_VALUE - 5) { + goto invalid; + } + switch (state) { case sw_chunk_start: @@ -2340,10 +2348,6 @@ } - if (ctx->size < 0 || ctx->length < 0) { - goto invalid; - } - return rc; done: