From f76275d4a91b28d687250525d3a0c5509bbd666f Mon Sep 17 00:00:00 2001 From: Sebastian Pipping Date: Sun, 23 Sep 2018 21:30:39 +0200 Subject: [PATCH] UriQuery.c: Catch integer overflow in ComposeQuery and ...Ex --- lib/UriQuery.c | 14 ++++++++++++-- 1 files changed, 12 insertions(+), 2 deletions(-) diff --git a/lib/UriQuery.c b/lib/UriQuery.c index 45acf5a..9165ec8 100644 --- a/lib/UriQuery.c +++ b/lib/UriQuery.c @@ -64,6 +64,10 @@ +#include + + + static int URI_FUNC(ComposeQueryEngine)(URI_CHAR * dest, const URI_TYPE(QueryList) * queryList, int maxChars, int * charsWritten, int * charsRequired, @@ -197,9 +201,15 @@ int URI_FUNC(ComposeQueryEngine)(URI_CHAR * dest, const URI_CHAR * const value = queryList->value; const int worstCase = (normalizeBreaks == URI_TRUE ? 6 : 3); const int keyLen = (key == NULL) ? 0 : (int)URI_STRLEN(key); - const int keyRequiredChars = worstCase * keyLen; + int keyRequiredChars; const int valueLen = (value == NULL) ? 0 : (int)URI_STRLEN(value); - const int valueRequiredChars = worstCase * valueLen; + int valueRequiredChars; + + if ((keyLen >= INT_MAX / worstCase) || (valueLen >= INT_MAX / worstCase)) { + return URI_ERROR_OUTPUT_TOO_LARGE; + } + keyRequiredChars = worstCase * keyLen; + valueRequiredChars = worstCase * valueLen; if (dest == NULL) { if (firstItem == URI_TRUE) {