From 760ade2947415dbb100053cf793c2f96fe257386 Mon Sep 17 00:00:00 2001 From: Sebastian Pipping Date: Sun, 28 Apr 2024 21:26:45 +0200 Subject: [PATCH] Protect against integer overflow in ComposeQueryEngine Requires string input that is longer than INT_MAX to exploit. --- src/UriQuery.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/src/UriQuery.c b/src/UriQuery.c index b2734bc2..29c6f473 100644 --- a/src/UriQuery.c +++ b/src/UriQuery.c @@ -70,6 +70,7 @@ #include +#include /* size_t */ @@ -218,16 +219,16 @@ int URI_FUNC(ComposeQueryEngine)(URI_CHAR * dest, const URI_CHAR * const key = queryList->key; const URI_CHAR * const value = queryList->value; const int worstCase = (normalizeBreaks == URI_TRUE ? 6 : 3); - const int keyLen = (key == NULL) ? 0 : (int)URI_STRLEN(key); + const size_t keyLen = (key == NULL) ? 0 : URI_STRLEN(key); int keyRequiredChars; - const int valueLen = (value == NULL) ? 0 : (int)URI_STRLEN(value); + const size_t valueLen = (value == NULL) ? 0 : URI_STRLEN(value); int valueRequiredChars; - if ((keyLen >= INT_MAX / worstCase) || (valueLen >= INT_MAX / worstCase)) { + if ((keyLen >= (size_t)INT_MAX / worstCase) || (valueLen >= (size_t)INT_MAX / worstCase)) { return URI_ERROR_OUTPUT_TOO_LARGE; } - keyRequiredChars = worstCase * keyLen; - valueRequiredChars = worstCase * valueLen; + keyRequiredChars = worstCase * (int)keyLen; + valueRequiredChars = worstCase * (int)valueLen; if (dest == NULL) { (*charsRequired) += ampersandLen + keyRequiredChars + ((value == NULL)