nginx: src/http/modules/ngx_http_range_filter

Overflow detection in ngx_http_range_parse().

comparison

equal deleted inserted replaced

-:b2a2475b2008
+:a77b625641c7
 static ngx_int_t
 ngx_http_range_parse(ngx_http_request_t *r, ngx_http_range_filter_ctx_t *ctx,
 ngx_uint_t ranges)
 {
 u_char            *p;
-off_t              start, end, size, content_length;
+off_t              start, end, size, content_length, cutoff, cutlim;
 ngx_uint_t         suffix;
 ngx_http_range_t  *range;
 p = r->headers_in.range->value.data + 6;
 size = 0;
 content_length = r->headers_out.content_length_n;
+cutoff = NGX_MAX_OFF_T_VALUE / 10;
+cutlim = NGX_MAX_OFF_T_VALUE % 10;
 for ( ;; ) {
 start = 0;
 end = 0;
 suffix = 0;
 if (*p < '0' || *p > '9') {
 return NGX_HTTP_RANGE_NOT_SATISFIABLE;
 }
 while (*p >= '0' && *p <= '9') {
+if (start >= cutoff && (start > cutoff || *p - '0' > cutlim)) {
+return NGX_HTTP_RANGE_NOT_SATISFIABLE;
+}
 start = start * 10 + *p++ - '0';
 }
 while (*p == ' ') { p++; }
 if (*p < '0' || *p > '9') {
 return NGX_HTTP_RANGE_NOT_SATISFIABLE;
 }
 while (*p >= '0' && *p <= '9') {
+if (end >= cutoff && (end > cutoff || *p - '0' > cutlim)) {
+return NGX_HTTP_RANGE_NOT_SATISFIABLE;
+}
 end = end * 10 + *p++ - '0';
 }
 while (*p == ' ') { p++; }

Mercurial > hg > nginx