From a5e3be4a0cd4f75192694e505e89172bb4357f59 Mon Sep 17 00:00:00 2001 From: Emmanuel Fleury Date: Tue, 9 Feb 2021 18:07:20 +0000 Subject: [PATCH] Adding a missing test on integer overflow within g_http_proxy_connect() Fixes #2315 --- gio/ghttpproxy.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/gio/ghttpproxy.c b/gio/ghttpproxy.c index cd0bda4e6..505a8fecb 100644 --- a/gio/ghttpproxy.c +++ b/gio/ghttpproxy.c @@ -255,6 +255,17 @@ g_http_proxy_connect (GProxy *proxy, if (bytes_read == buffer_length) { + /* HTTP specifications does not defines any upper limit for + * headers. But, the most usual size used seems to be 8KB. + * Yet, the biggest we found was Tomcat's HTTP headers whose + * size is 48K. So, for a reasonable error margin, let's accept + * a header with a twice as large size but no more: 96KB */ + if (buffer_length > 98304) + { + g_set_error_literal (error, G_IO_ERROR, G_IO_ERROR_PROXY_FAILED, + _("HTTP proxy response too big")); + goto error; + } buffer_length = 2 * buffer_length; buffer = g_realloc (buffer, buffer_length); }