From f76275d4a91b28d687250525d3a0c5509bbd666f Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Sun, 23 Sep 2018 21:30:39 +0200
Subject: [PATCH] UriQuery.c: Catch integer overflow in ComposeQuery and ...Ex

---
 lib/UriQuery.c | 14 ++++++++++++--
 1 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/lib/UriQuery.c b/lib/UriQuery.c
index 45acf5a..9165ec8 100644
--- a/lib/UriQuery.c
+++ b/lib/UriQuery.c
@@ -64,6 +64,10 @@
 
 
 
+#include <limits.h>
+
+
+
 static int URI_FUNC(ComposeQueryEngine)(URI_CHAR * dest,
 		const URI_TYPE(QueryList) * queryList,
 		int maxChars, int * charsWritten, int * charsRequired,
@@ -197,9 +201,15 @@ int URI_FUNC(ComposeQueryEngine)(URI_CHAR * dest,
 		const URI_CHAR * const value = queryList->value;
 		const int worstCase = (normalizeBreaks == URI_TRUE ? 6 : 3);
 		const int keyLen = (key == NULL) ? 0 : (int)URI_STRLEN(key);
-		const int keyRequiredChars = worstCase * keyLen;
+		int keyRequiredChars;
 		const int valueLen = (value == NULL) ? 0 : (int)URI_STRLEN(value);
-		const int valueRequiredChars = worstCase * valueLen;
+		int valueRequiredChars;
+
+		if ((keyLen >= INT_MAX / worstCase) || (valueLen >= INT_MAX / worstCase)) {
+			return URI_ERROR_OUTPUT_TOO_LARGE;
+		}
+		keyRequiredChars = worstCase * keyLen;
+		valueRequiredChars = worstCase * valueLen;
 
 		if (dest == NULL) {
 			if (firstItem == URI_TRUE) {