crtxcr/cgitsb
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

filter: avoid integer overflow in authenticate_post

Browse Source 
ctx.env.content_length is an unsigned int, coming from the
CONTENT_LENGTH environment variable, which is parsed by strtoul. The
HTTP/1.1 spec says that "any Content-Length greater than or equal to
zero is a valid value." By storing this into an int, we potentially
overflow it, resulting in the following bounding check failing, leading
to a buffer overflow.

Reported-by: Erik Cabetas <Erik@cabetas.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
This commit is contained in:
Jason A. Donenfeld 2015-11-24 11:28:00 +01:00
parent ffe09621f2
commit 4458abf641
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
cgit.c
View File

@ -651,7 +651,7 @@ static inline void open_auth_filter(const char *function)
static inline void authenticate_post(void) static inline void authenticate_post(void)
{ {
char buffer[MAX_AUTHENTICATION_POST_BYTES]; char buffer[MAX_AUTHENTICATION_POST_BYTES];
int len; unsigned int len;
open_auth_filter("authenticate-post"); open_auth_filter("authenticate-post");
len = ctx.env.content_length; len = ctx.env.content_length;