Commit d8e059b3 authored by Aaron Bannert's avatar Aaron Bannert
Browse files

Properly detect overflow when reading the hex chunk lines. 


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@95342 13f79535-47bb-0310-9956-ffa450edef68
parent 6b419c62

CHANGES

+3 −0
Changes for CHANGES: 3 added lines, 0 removed lines.
Original line number Diff line number Diff line 
Changes with Apache 2.0.37









  *) Detect overflow when reading the hex bytes forming a chunk line.









     [Aaron Bannert]

















  *) Allow RewriteMap prg:'s to take command-line arguments.  PR 8464.









     [James Tait <JTait@wyrddreams.demon.co.uk>]










































modules/http/http_protocol.c



+9
−3



























Changes for modules/http/http_protocol.c: 9 added lines, 3 removed lines.



Original line number
Diff line number
Diff line







@@ -859,7 +859,7 @@ apr_status_t ap_http_filter(ap_filter_t *f, apr_bucket_brigade *b,







            apr_brigade_flatten(bb, line, &len);



















            ctx->remaining = get_chunk_size(line);









            /* Detect invalid chunk sizes. */









            /* Detect chunksize error (such as overflow) */









            if (ctx->remaining < 0) {









                apr_brigade_cleanup(bb);









                e = ap_bucket_error_create(HTTP_REQUEST_ENTITY_TOO_LARGE, NULL,










@@ -908,7 +908,7 @@ apr_status_t ap_http_filter(ap_filter_t *f, apr_bucket_brigade *b,







                apr_brigade_flatten(bb, line, &len);









                ctx->remaining = get_chunk_size(line);



















                /* Detect invalid chunk sizes. */









                /* Detect chunksize error (such as overflow) */









                if (ctx->remaining < 0) {









                    apr_brigade_cleanup(bb);









                    e = ap_bucket_error_create(HTTP_REQUEST_ENTITY_TOO_LARGE,










@@ -1690,8 +1690,9 @@ AP_DECLARE(int) ap_should_client_block(request_rec *r)







static long get_chunk_size(char *b)









{









    long chunksize = 0;









    size_t chunkbits = sizeof(long) * 8;



















    while (apr_isxdigit(*b)) {









    while (apr_isxdigit(*b) && (chunkbits > 0)) {









        int xvalue = 0;



















        if (*b >= '0' && *b <= '9') {










@@ -1705,8 +1706,13 @@ static long get_chunk_size(char *b)







        }



















        chunksize = (chunksize << 4) | xvalue;









        chunkbits -= 4;









        ++b;









    }









    if (apr_isxdigit(*b) && (chunkbits <= 0)) {









        /* overflow */









        return -1;









    }



















    return chunksize;









}