rustls: cap maximum allowed CRL file size to 8MB

Allowing 4GB on a 32-bit system is just asking for problems and could in
theory cause integer overflow in the dynbuf code.

The dynbuf now has an assert to catch code trying to set a max larger
than half SIZE_T_MAX.

Reported-by: Rinku Das
Closes #16716
This commit is contained in:
Daniel Stenberg 2025-03-14 08:28:02 +01:00
parent 27e07b2943
commit 116f490c81
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 5 additions and 1 deletions

View file

@ -43,6 +43,7 @@ void Curl_dyn_init(struct dynbuf *s, size_t toobig)
{
DEBUGASSERT(s);
DEBUGASSERT(toobig);
DEBUGASSERT(toobig <= MAX_DYNBUF_SIZE); /* catch crazy mistakes */
s->bufr = NULL;
s->leng = 0;
s->allc = 0;