mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-10 00:04:06 -09:00
2a99d1d195
Backport the upstream fix for integer overflows while parsing
Content-Range headers, together with the follow-up fix using
strtoll() for wgint values.
Backport to: 2025.02.x
Signed-off-by: Stefan Müller <stemu86@gmx.ch>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 89485adb29)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
81 lines
2.2 KiB
Diff
81 lines
2.2 KiB
Diff
From 43d3ba9336bc94937e6fae2365c6ffd30c34ffcf Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Tim=20R=C3=BChsen?= <tim.ruehsen@gmx.de>
|
|
Date: Mon, 29 Jun 2026 18:57:54 +0200
|
|
Subject: [PATCH] * src/http.c (parse_content_range): Fix integer overflow
|
|
|
|
Reported-by: TristanInSec@gmail.com
|
|
CVE: CVE-2026-58470
|
|
Upstream: https://gitlab.com/gnuwget/wget/-/commit/43d3ba9336bc94937e6fae2365c6ffd30c34ffcf
|
|
Signed-off-by: Stefan Müller <stemu86@gmx.ch>
|
|
|
|
---
|
|
src/http.c | 35 ++++++++++++++++++++++++-----------
|
|
1 file changed, 24 insertions(+), 11 deletions(-)
|
|
|
|
diff --git a/src/http.c b/src/http.c
|
|
index 61d83df1..f447c7f7 100644
|
|
--- a/src/http.c
|
|
+++ b/src/http.c
|
|
@@ -914,6 +914,7 @@ parse_content_range (const char *hdr, wgint *first_byte_ptr,
|
|
wgint *last_byte_ptr, wgint *entity_length_ptr)
|
|
{
|
|
wgint num;
|
|
+ char *end;
|
|
|
|
/* Ancient versions of Netscape proxy server, presumably predating
|
|
rfc2068, sent out `Content-Range' without the "bytes"
|
|
@@ -932,27 +933,39 @@ parse_content_range (const char *hdr, wgint *first_byte_ptr,
|
|
}
|
|
if (!c_isdigit (*hdr))
|
|
return false;
|
|
- for (num = 0; c_isdigit (*hdr); hdr++)
|
|
- num = 10 * num + (*hdr - '0');
|
|
- if (*hdr != '-' || !c_isdigit (*(hdr + 1)))
|
|
+
|
|
+ errno = 0;
|
|
+ num = strtol(hdr, &end, 10);
|
|
+ if (errno == ERANGE)
|
|
+ return false;
|
|
+ hdr = end;
|
|
+
|
|
+ if (*hdr++ != '-' || !c_isdigit (*hdr))
|
|
return false;
|
|
*first_byte_ptr = num;
|
|
- ++hdr;
|
|
- for (num = 0; c_isdigit (*hdr); hdr++)
|
|
- num = 10 * num + (*hdr - '0');
|
|
- if (*hdr != '/')
|
|
+
|
|
+ errno = 0;
|
|
+ num = strtol(hdr, &end, 10);
|
|
+ if (errno == ERANGE)
|
|
+ return false;
|
|
+ hdr = end;
|
|
+
|
|
+ if (*hdr++ != '/')
|
|
return false;
|
|
*last_byte_ptr = num;
|
|
- if (!(c_isdigit (*(hdr + 1)) || *(hdr + 1) == '*'))
|
|
+ if (!(c_isdigit (*hdr) || *hdr == '*'))
|
|
return false;
|
|
if (*last_byte_ptr < *first_byte_ptr)
|
|
return false;
|
|
- ++hdr;
|
|
if (*hdr == '*')
|
|
num = -1;
|
|
else
|
|
- for (num = 0; c_isdigit (*hdr); hdr++)
|
|
- num = 10 * num + (*hdr - '0');
|
|
+ {
|
|
+ errno = 0;
|
|
+ num = strtol(hdr, NULL, 10);
|
|
+ if (errno == ERANGE)
|
|
+ return false;
|
|
+ }
|
|
*entity_length_ptr = num;
|
|
if ((*entity_length_ptr <= *last_byte_ptr) && *entity_length_ptr != -1)
|
|
return false;
|
|
--
|
|
GitLab
|
|
|