Mercurial > hg > nginx
changeset 6014:e370c5fdf4c8
Overflow detection in ngx_http_parse_chunked().
author | Ruslan Ermilov <ru@nginx.com> |
---|---|
date | Tue, 17 Mar 2015 00:26:27 +0300 |
parents | 9653092a79fd |
children | e11a8e7e8e0c |
files | src/http/ngx_http_parse.c |
diffstat | 1 files changed, 8 insertions(+), 4 deletions(-) [+] |
line wrap: on
line diff
--- a/src/http/ngx_http_parse.c Tue Mar 17 00:26:24 2015 +0300 +++ b/src/http/ngx_http_parse.c Tue Mar 17 00:26:27 2015 +0300 @@ -2155,6 +2155,10 @@ goto invalid; case sw_chunk_size: + if (ctx->size > NGX_MAX_OFF_T_VALUE / 16) { + goto invalid; + } + if (ch >= '0' && ch <= '9') { ctx->size = ctx->size * 16 + (ch - '0'); break; @@ -2304,6 +2308,10 @@ ctx->state = state; b->pos = pos; + if (ctx->size > NGX_MAX_OFF_T_VALUE - 5) { + goto invalid; + } + switch (state) { case sw_chunk_start: @@ -2340,10 +2348,6 @@ } - if (ctx->size < 0 || ctx->length < 0) { - goto invalid; - } - return rc; done: