Fix #768: Add check for 'signed int' overflow.

tempesta-tech · Aug 23, 2017 · 576dd0e · 576dd0e
1 parent 9df1d21
commit 576dd0e
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 3 deletions.
diff --git a/tempesta_fw/http_parser.c b/tempesta_fw/http_parser.c
@@ -483,12 +483,13 @@ parse_int_hex(unsigned char *data, size_t len, unsigned long *acc, unsigned shor
 	unsigned char *p;
 
 	for (p = data; p - data < len; ++p) {
-		if (unlikely(IS_CRLF(*p) || (*p == ';')))
+		if (unlikely(IS_CRLF(*p) || (*p == ';'))) {
+			if (unlikely(*acc > INT_MAX))
+				return CSTR_BADLEN;
 			return p - data;
+		}
 		if (unlikely(!isxdigit(*p)))
 			return CSTR_NEQ;
-		if (unlikely(*acc > (UINT_MAX - 16) / 16))
-			return CSTR_BADLEN;
 		if (unlikely(*cnt >= (sizeof(int) * 2)))
 			return CSTR_BADLEN;
 		*acc = (*acc << 4) + (*p & 0xf) + (*p >> 6) * 9;

diff --git a/tempesta_fw/t/unit/test_http_parser.c b/tempesta_fw/t/unit/test_http_parser.c
@@ -1145,6 +1145,15 @@ TEST(http_parser, chunk_size)
 			 "000000000\r\n"
 			 "\r\n");
 
+	EXPECT_BLOCK_REQ("POST / HTTP/1.1\r\n"
+			 "Host:\r\n"
+			 "Transfer-Encoding: chunked\r\n"
+			 "\r\n"
+			 "80000000\r\n"
+			 "abcdefg\r\n"
+			 "0\r\n"
+			 "\r\n");
+
 	FOR_REQ("POST / HTTP/1.1\r\n"
 		"Host:\r\n"
 		"Transfer-Encoding: chunked\r\n"