Blame SOURCES/nginx-1.10.2-CVE-2017-7529.patch

ae9c3d
diffsrc/http/modules/ngx_http_range_filter_module.c b/src/http/modules/ngx_http_range_filter_module.c
ae9c3d
--- src/http/modules/ngx_http_range_filter_module.c
ae9c3d
+++ src/http/modules/ngx_http_range_filter_module.c
ae9c3d
@@ -377,6 +377,10 @@ ngx_http_range_parse(ngx_http_request_t 
ae9c3d
             range->start = start;
ae9c3d
             range->end = end;
ae9c3d
 
ae9c3d
+            if (size > NGX_MAX_OFF_T_VALUE - (end - start)) {
ae9c3d
+                return NGX_HTTP_RANGE_NOT_SATISFIABLE;
ae9c3d
+            }
ae9c3d
+
ae9c3d
             size += end - start;
ae9c3d
 
ae9c3d
             if (ranges-- == 0) {