Browse Source

[core] consolidate chunk size checks

master
Glenn Strauss 2 years ago
parent
commit
edfc5f394e
  1. 2
      src/connections.c
  2. 7
      src/http_chunk.c

2
src/connections.c

@ -1722,7 +1722,7 @@ connection_handle_read_post_chunked (request_st * const r, chunkqueue * const cq
off_t hsz = p + 1 - (c->mem->ptr+c->offset);
unsigned char *s = (unsigned char *)c->mem->ptr+c->offset;
for (unsigned char u;(u=(unsigned char)hex2int(*s))!=0xFF;++s) {
if (te_chunked > (off_t)(1uLL<<(8*sizeof(off_t)-5))-1) {
if (te_chunked > (off_t)(1uLL<<(8*sizeof(off_t)-5))-1-2) {
log_error(r->conf.errh, __FILE__, __LINE__,
"chunked data size too large -> 400");
/* 400 Bad Request */

7
src/http_chunk.c

@ -350,7 +350,7 @@ http_chunk_decode_append_data (request_st * const r, const char *mem, off_t len)
s = (unsigned char *)h->ptr;
}
for (unsigned char u; (u=(unsigned char)hex2int(*s))!=0xFF; ++s) {
if (te_chunked > (off_t)(1uLL<<(8*sizeof(off_t)-5))-1) {
if (te_chunked > (off_t)(1uLL<<(8*sizeof(off_t)-5))-1-2) {
log_error(r->conf.errh, __FILE__, __LINE__,
"chunked data size too large");
return -1;
@ -419,11 +419,6 @@ http_chunk_decode_append_data (request_st * const r, const char *mem, off_t len)
mem += hsz;
len -= hsz;
if (te_chunked > (off_t)(1uLL<<(8*sizeof(off_t)-5))-1-2) {
log_error(r->conf.errh, __FILE__, __LINE__,
"chunked data size too large");
return -1;
}
te_chunked += 2; /*(for trailing "\r\n" after chunked data)*/
}

Loading…
Cancel
Save