From 43d3ba9336bc94937e6fae2365c6ffd30c34ffcf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tim=20R=C3=BChsen?= Date: Mon, 29 Jun 2026 18:57:54 +0200 Subject: [PATCH] * src/http.c (parse_content_range): Fix integer overflow Reported-by: TristanInSec@gmail.com CVE: CVE-2026-58470 Upstream: https://gitlab.com/gnuwget/wget/-/commit/43d3ba9336bc94937e6fae2365c6ffd30c34ffcf Signed-off-by: Stefan Müller --- src/http.c | 35 ++++++++++++++++++++++++----------- 1 file changed, 24 insertions(+), 11 deletions(-) diff --git a/src/http.c b/src/http.c index 61d83df1..f447c7f7 100644 --- a/src/http.c +++ b/src/http.c @@ -914,6 +914,7 @@ parse_content_range (const char *hdr, wgint *first_byte_ptr, wgint *last_byte_ptr, wgint *entity_length_ptr) { wgint num; + char *end; /* Ancient versions of Netscape proxy server, presumably predating rfc2068, sent out `Content-Range' without the "bytes" @@ -932,27 +933,39 @@ parse_content_range (const char *hdr, wgint *first_byte_ptr, } if (!c_isdigit (*hdr)) return false; - for (num = 0; c_isdigit (*hdr); hdr++) - num = 10 * num + (*hdr - '0'); - if (*hdr != '-' || !c_isdigit (*(hdr + 1))) + + errno = 0; + num = strtol(hdr, &end, 10); + if (errno == ERANGE) + return false; + hdr = end; + + if (*hdr++ != '-' || !c_isdigit (*hdr)) return false; *first_byte_ptr = num; - ++hdr; - for (num = 0; c_isdigit (*hdr); hdr++) - num = 10 * num + (*hdr - '0'); - if (*hdr != '/') + + errno = 0; + num = strtol(hdr, &end, 10); + if (errno == ERANGE) + return false; + hdr = end; + + if (*hdr++ != '/') return false; *last_byte_ptr = num; - if (!(c_isdigit (*(hdr + 1)) || *(hdr + 1) == '*')) + if (!(c_isdigit (*hdr) || *hdr == '*')) return false; if (*last_byte_ptr < *first_byte_ptr) return false; - ++hdr; if (*hdr == '*') num = -1; else - for (num = 0; c_isdigit (*hdr); hdr++) - num = 10 * num + (*hdr - '0'); + { + errno = 0; + num = strtol(hdr, NULL, 10); + if (errno == ERANGE) + return false; + } *entity_length_ptr = num; if ((*entity_length_ptr <= *last_byte_ptr) && *entity_length_ptr != -1) return false; -- GitLab