Skip to content

V
varnish-cache
Commit 6b944c3a authored by Federico G. Schwindt's avatar Federico G. Schwindt
Browse files
Options

Rework to avoid UB 

Fixes #2617
parent 0fe51283
Hide whitespace changes
Inline Side-by-side
Showing with 7 additions and 4 deletions
bin/varnishd/cache/cache_http.c
View file @ 6b944c3a
...@@ -669,8 +669,9 @@ http_GetHdrField(const struct http *hp, const char *hdr, ...@@ -669,8 +669,9 @@ http_GetHdrField(const struct http *hp, const char *hdr,
ssize_t ssize_t
http_GetContentLength(const struct http *hp) http_GetContentLength(const struct http *hp)
{ {
ssize_t cl, cll; ssize_t cl;
const char *b; const char *b;
unsigned n;
CHECK_OBJ_NOTNULL(hp, HTTP_MAGIC); CHECK_OBJ_NOTNULL(hp, HTTP_MAGIC);
...@@ -680,11 +681,13 @@ http_GetContentLength(const struct http *hp) ...@@ -680,11 +681,13 @@ http_GetContentLength(const struct http *hp)
if (!vct_isdigit(*b)) if (!vct_isdigit(*b))
return (-2); return (-2);
for (; vct_isdigit(*b); b++) { for (; vct_isdigit(*b); b++) {
cll = cl; if (cl > (SSIZE_MAX / 10))
return (-2);
cl *= 10; cl *= 10;
cl += *b - '0'; n = *b - '0';
if (cll != cl / 10) if (cl > (SSIZE_MAX - n))
return (-2); return (-2);
cl += n;
} }
while (vct_islws(*b)) while (vct_islws(*b))
b++; b++;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment