neocgit

a more 'modern' version of cgit
Log | Files | Refs | Submodules | README | LICENSE | git clone https://git.ne02ptzero.me/git/neocgit

commit 4458abf64172a62b92810c2293450106e6dfc763
parent ffe09621f2626c692a16b249a52112ba8070aa79
Author: Jason A. Donenfeld <Jason@zx2c4.com>
Date:   Tue, 24 Nov 2015 11:28:00 +0100

filter: avoid integer overflow in authenticate_post

ctx.env.content_length is an unsigned int, coming from the
CONTENT_LENGTH environment variable, which is parsed by strtoul. The
HTTP/1.1 spec says that "any Content-Length greater than or equal to
zero is a valid value." By storing this into an int, we potentially
overflow it, resulting in the following bounding check failing, leading
to a buffer overflow.

Reported-by: Erik Cabetas <Erik@cabetas.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

Diffstat:
Mcgit.c | 2+-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cgit.c b/cgit.c @@ -651,7 +651,7 @@ static inline void open_auth_filter(const char *function) static inline void authenticate_post(void) { char buffer[MAX_AUTHENTICATION_POST_BYTES]; - int len; + unsigned int len; open_auth_filter("authenticate-post"); len = ctx.env.content_length;