|
 |
2da346 |
From 34d361188adc4b4a81457bcffb14588d84078e79 Mon Sep 17 00:00:00 2001
|
|
|
2da346 |
From: Dan Winship <danw@gnome.org>
|
|
|
2da346 |
Date: Thu, 3 Aug 2017 09:56:43 -0400
|
|
|
2da346 |
Subject: [PATCH] Fix chunked decoding buffer overrun (CVE-2017-2885)
|
|
|
2da346 |
|
|
|
2da346 |
https://bugzilla.gnome.org/show_bug.cgi?id=785774
|
|
|
2da346 |
---
|
|
|
2da346 |
libsoup/soup-filter-input-stream.c | 22 +++++++++++-----------
|
|
|
2da346 |
1 file changed, 11 insertions(+), 11 deletions(-)
|
|
|
2da346 |
|
|
|
2da346 |
diff --git a/libsoup/soup-filter-input-stream.c b/libsoup/soup-filter-input-stream.c
|
|
|
2da346 |
index cde4d12..2c30bf9 100644
|
|
|
2da346 |
--- a/libsoup/soup-filter-input-stream.c
|
|
|
2da346 |
+++ b/libsoup/soup-filter-input-stream.c
|
|
|
2da346 |
@@ -198,7 +198,7 @@ soup_filter_input_stream_read_until (SoupFilterInputStream *fstream,
|
|
|
2da346 |
GCancellable *cancellable,
|
|
|
2da346 |
GError **error)
|
|
|
2da346 |
{
|
|
|
2da346 |
- gssize nread;
|
|
|
2da346 |
+ gssize nread, read_length;
|
|
|
2da346 |
guint8 *p, *buf, *end;
|
|
|
2da346 |
gboolean eof = FALSE;
|
|
|
2da346 |
GError *my_error = NULL;
|
|
|
2da346 |
@@ -251,10 +251,11 @@ soup_filter_input_stream_read_until (SoupFilterInputStream *fstream,
|
|
|
2da346 |
} else
|
|
|
2da346 |
buf = fstream->priv->buf->data;
|
|
|
2da346 |
|
|
|
2da346 |
- /* Scan for the boundary */
|
|
|
2da346 |
- end = buf + fstream->priv->buf->len;
|
|
|
2da346 |
- if (!eof)
|
|
|
2da346 |
- end -= boundary_length;
|
|
|
2da346 |
+ /* Scan for the boundary within the range we can possibly return. */
|
|
|
2da346 |
+ if (include_boundary)
|
|
|
2da346 |
+ end = buf + MIN (fstream->priv->buf->len, length) - boundary_length;
|
|
|
2da346 |
+ else
|
|
|
2da346 |
+ end = buf + MIN (fstream->priv->buf->len - boundary_length, length);
|
|
|
2da346 |
for (p = buf; p <= end; p++) {
|
|
|
2da346 |
if (*p == *(guint8*)boundary &&
|
|
|
2da346 |
!memcmp (p, boundary, boundary_length)) {
|
|
|
2da346 |
@@ -268,10 +269,9 @@ soup_filter_input_stream_read_until (SoupFilterInputStream *fstream,
|
|
|
2da346 |
if (!*got_boundary && fstream->priv->buf->len < length && !eof)
|
|
|
2da346 |
goto fill_buffer;
|
|
|
2da346 |
|
|
|
2da346 |
- /* Return everything up to 'p' (which is either just after the boundary if
|
|
|
2da346 |
- * include_boundary is TRUE, just before the boundary if include_boundary is
|
|
|
2da346 |
- * FALSE, @boundary_len - 1 bytes before the end of the buffer, or end-of-
|
|
|
2da346 |
- * file).
|
|
|
2da346 |
- */
|
|
|
2da346 |
- return read_from_buf (fstream, buffer, p - buf);
|
|
|
2da346 |
+ if (eof && !*got_boundary)
|
|
|
2da346 |
+ read_length = MIN (fstream->priv->buf->len, length);
|
|
|
2da346 |
+ else
|
|
|
2da346 |
+ read_length = p - buf;
|
|
|
2da346 |
+ return read_from_buf (fstream, buffer, read_length);
|
|
|
2da346 |
}
|
|
|
2da346 |
--
|
|
|
2da346 |
2.9.4
|