From f76275d4a91b28d687250525d3a0c5509bbd666f Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Sun, 23 Sep 2018 21:30:39 +0200
Subject: [PATCH] UriQuery.c: Catch integer overflow in ComposeQuery and ...Ex
---
lib/UriQuery.c | 14 ++++++++++++--
1 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/lib/UriQuery.c b/lib/UriQuery.c
index 45acf5a..9165ec8 100644
--- a/lib/UriQuery.c
+++ b/lib/UriQuery.c
@@ -64,6 +64,10 @@
+#include <limits.h>
+
+
+
static int URI_FUNC(ComposeQueryEngine)(URI_CHAR * dest,
const URI_TYPE(QueryList) * queryList,
int maxChars, int * charsWritten, int * charsRequired,
@@ -197,9 +201,15 @@ int URI_FUNC(ComposeQueryEngine)(URI_CHAR * dest,
const URI_CHAR * const value = queryList->value;
const int worstCase = (normalizeBreaks == URI_TRUE ? 6 : 3);
const int keyLen = (key == NULL) ? 0 : (int)URI_STRLEN(key);
- const int keyRequiredChars = worstCase * keyLen;
+ int keyRequiredChars;
const int valueLen = (value == NULL) ? 0 : (int)URI_STRLEN(value);
- const int valueRequiredChars = worstCase * valueLen;
+ int valueRequiredChars;
+
+ if ((keyLen >= INT_MAX / worstCase) || (valueLen >= INT_MAX / worstCase)) {
+ return URI_ERROR_OUTPUT_TOO_LARGE;
+ }
+ keyRequiredChars = worstCase * keyLen;
+ valueRequiredChars = worstCase * valueLen;
if (dest == NULL) {
if (firstItem == URI_TRUE) {