www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2025-08-08 15:02:10 +03:00
Code Activity

Properly detect overflow when reading the hex chunk lines.

Browse Source 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@95342 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Aaron Bannert
2002-05-29 06:42:58 +00:00
parent 2b334fc033
commit 0310c2dff7
2 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGES
View File

@@ -1,5 +1,8 @@
Changes with Apache 2.0.37
*) Detect overflow when reading the hex bytes forming a chunk line.
[Aaron Bannert]
*) Allow RewriteMap prg:'s to take command-line arguments. PR 8464.
[James Tait <JTait@wyrddreams.demon.co.uk>]

12
modules/http/http_protocol.c
View File

@@ -859,7 +859,7 @@ apr_status_t ap_http_filter(ap_filter_t *f, apr_bucket_brigade *b,
apr_brigade_flatten(bb, line, &len);
ctx->remaining = get_chunk_size(line);
/* Detect invalid chunk sizes. */
/* Detect chunksize error (such as overflow) */
if (ctx->remaining < 0) {
apr_brigade_cleanup(bb);
e = ap_bucket_error_create(HTTP_REQUEST_ENTITY_TOO_LARGE, NULL,
@@ -908,7 +908,7 @@ apr_status_t ap_http_filter(ap_filter_t *f, apr_bucket_brigade *b,
apr_brigade_flatten(bb, line, &len);
ctx->remaining = get_chunk_size(line);
/* Detect invalid chunk sizes. */
/* Detect chunksize error (such as overflow) */
if (ctx->remaining < 0) {
apr_brigade_cleanup(bb);
e = ap_bucket_error_create(HTTP_REQUEST_ENTITY_TOO_LARGE,
@@ -1690,8 +1690,9 @@ AP_DECLARE(int) ap_should_client_block(request_rec *r)
static long get_chunk_size(char *b)
{
long chunksize = 0;
size_t chunkbits = sizeof(long) * 8;
while (apr_isxdigit(*b)) {
while (apr_isxdigit(*b) && (chunkbits > 0)) {
int xvalue = 0;
if (*b >= '0' && *b <= '9') {
@@ -1705,8 +1706,13 @@ static long get_chunk_size(char *b)
}
chunksize = (chunksize << 4) | xvalue;
chunkbits -= 4;
++b;
}
if (apr_isxdigit(*b) && (chunkbits <= 0)) {
/* overflow */
return -1;
}
return chunksize;
}