| From f0f1f4b22d6a98536377a1bb07e7c20e4703d229 Mon Sep 17 00:00:00 2001 |
| From: Thomas Bernard <miniupnp@free.fr> |
| Date: Tue, 9 May 2017 12:00:47 +0200 |
| Subject: [PATCH] miniupnpc: Fix CVE-2017-8798 |
| |
| Thanks to tin/Team OSTStrom |
| |
| [Peter: drop Changelog.txt modification, convert to -p1 format] |
| Signed-off-by: Peter Korsgaard <peter@korsgaard.com> |
| --- |
| miniupnpc/miniwget.c | 12 +++++++----- |
| 1 file changed, 9 insertions(+), 5 deletions(-) |
| |
| diff --git a/miniwget.c b/miniwget.c |
| index 37cb47b7..1eda57c5 100644 |
| --- a/miniwget.c |
| +++ b/miniwget.c |
| @@ -284,11 +284,12 @@ getHTTPResponse(int s, int * size, int * status_code) |
| goto end_of_stream; |
| } |
| } |
| - bytestocopy = ((int)chunksize < (n - i))?chunksize:(unsigned int)(n - i); |
| + /* it is guaranteed that (n >= i) */ |
| + bytestocopy = (chunksize < (unsigned int)(n - i))?chunksize:(unsigned int)(n - i); |
| if((content_buf_used + bytestocopy) > content_buf_len) |
| { |
| char * tmp; |
| - if(content_length >= (int)(content_buf_used + bytestocopy)) { |
| + if((content_length >= 0) && ((unsigned int)content_length >= (content_buf_used + bytestocopy))) { |
| content_buf_len = content_length; |
| } else { |
| content_buf_len = content_buf_used + bytestocopy; |
| @@ -313,14 +314,15 @@ getHTTPResponse(int s, int * size, int * status_code) |
| { |
| /* not chunked */ |
| if(content_length > 0 |
| - && (int)(content_buf_used + n) > content_length) { |
| + && (content_buf_used + n) > (unsigned int)content_length) { |
| /* skipping additional bytes */ |
| n = content_length - content_buf_used; |
| } |
| if(content_buf_used + n > content_buf_len) |
| { |
| char * tmp; |
| - if(content_length >= (int)(content_buf_used + n)) { |
| + if(content_length >= 0 |
| + && (unsigned int)content_length >= (content_buf_used + n)) { |
| content_buf_len = content_length; |
| } else { |
| content_buf_len = content_buf_used + n; |
| @@ -340,7 +342,7 @@ getHTTPResponse(int s, int * size, int * status_code) |
| } |
| } |
| /* use the Content-Length header value if available */ |
| - if(content_length > 0 && (int)content_buf_used >= content_length) |
| + if(content_length > 0 && content_buf_used >= (unsigned int)content_length) |
| { |
| #ifdef DEBUG |
| printf("End of HTTP content\n"); |
