lighttpd
/
lighttpd1.4
2
0
Fork 0
Code Issues Releases Wiki Activity

[core] consolidate chunk size checks

This commit is contained in:
Glenn Strauss 2020-11-22 13:13:46 -05:00
parent 35fa47d802
commit edfc5f394e
2 changed files with 2 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/connections.c
View File

@ -1722,7 +1722,7 @@ connection_handle_read_post_chunked (request_st * const r, chunkqueue * const cq
off_t hsz = p + 1 - (c->mem->ptr+c->offset);
unsigned char *s = (unsigned char *)c->mem->ptr+c->offset;
for (unsigned char u;(u=(unsigned char)hex2int(*s))!=0xFF;++s) {
if (te_chunked > (off_t)(1uLL<<(8*sizeof(off_t)-5))-1) {
if (te_chunked > (off_t)(1uLL<<(8*sizeof(off_t)-5))-1-2) {
log_error(r->conf.errh, __FILE__, __LINE__,
"chunked data size too large -> 400");
/* 400 Bad Request */

7
src/http_chunk.c
View File

@ -350,7 +350,7 @@ http_chunk_decode_append_data (request_st * const r, const char *mem, off_t len)
s = (unsigned char *)h->ptr;
}
for (unsigned char u; (u=(unsigned char)hex2int(*s))!=0xFF; ++s) {
if (te_chunked > (off_t)(1uLL<<(8*sizeof(off_t)-5))-1) {
if (te_chunked > (off_t)(1uLL<<(8*sizeof(off_t)-5))-1-2) {
log_error(r->conf.errh, __FILE__, __LINE__,
"chunked data size too large");
return -1;
@ -419,11 +419,6 @@ http_chunk_decode_append_data (request_st * const r, const char *mem, off_t len)
mem += hsz;
len -= hsz;
if (te_chunked > (off_t)(1uLL<<(8*sizeof(off_t)-5))-1-2) {
log_error(r->conf.errh, __FILE__, __LINE__,
"chunked data size too large");
return -1;
}
te_chunked += 2; /*(for trailing "\r\n" after chunked data)*/
}