romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 20:03:52 +03:00
Code Issues Projects Releases Packages Wiki Activity

strtoofft: reduce integer overflow risks globally

Browse source 
... make sure we bail out on overflows.

Reported-by: Brian Carpenter
Closes #1758
This commit is contained in:
Daniel Stenberg 2017-08-14 23:33:23 +02:00
parent b53b4e4424
commit ff50fe0348
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
13 changed files with 196 additions and 131 deletions
Download patch file Download diff file Expand all files Collapse all files

17
lib/ssh.c
View file

@ -2233,18 +2233,25 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block)
curl_off_t from, to;
char *ptr;
char *ptr2;
CURLofft to_t;
CURLofft from_t;
from=curlx_strtoofft(conn->data->state.range, &ptr, 0);
from_t = curlx_strtoofft(conn->data->state.range, &ptr, 0, &from);
if(from_t == CURL_OFFT_FLOW)
return CURLE_RANGE_ERROR;
while(*ptr && (ISSPACE(*ptr) || (*ptr=='-')))
ptr++;
to=curlx_strtoofft(ptr, &ptr2, 0);
if((ptr == ptr2) /* no "to" value given */
to_t = curlx_strtoofft(ptr, &ptr2, 0, &to);
if(to_t == CURL_OFFT_FLOW)
return CURLE_RANGE_ERROR;
if((to_t == CURL_OFFT_INVAL) /* no "to" value given */
|| (to >= size)) {
to = size - 1;
}
if(from < 0) {
if(from_t) {
/* from is relative to end of file */
from += size;
from = size - to;
to = size - 1;
}
if(from > size) {
failf(data, "Offset (%"