diff --git a/mongoose.c b/mongoose.c index 23ed3362..1406453c 100644 --- a/mongoose.c +++ b/mongoose.c @@ -4195,11 +4195,12 @@ int mg_asprintf(char **buf, size_t size, const char *fmt, ...) { } int64_t mg_to64(struct mg_str str) { - int64_t result = 0, neg = 1; + int64_t result = 0, neg = 1, max = 922337203685477580 /* INT64_MAX / 10 */; size_t i = 0; while (i < str.len && (str.ptr[i] == ' ' || str.ptr[i] == '\t')) i++; if (i < str.len && str.ptr[i] == '-') neg = -1, i++; while (i < str.len && str.ptr[i] >= '0' && str.ptr[i] <= '9') { + if (result > max) return 0; result *= 10; result += (str.ptr[i] - '0'); i++; diff --git a/src/util.c b/src/util.c index 2943df73..d4f6c258 100644 --- a/src/util.c +++ b/src/util.c @@ -262,11 +262,12 @@ int mg_asprintf(char **buf, size_t size, const char *fmt, ...) { } int64_t mg_to64(struct mg_str str) { - int64_t result = 0, neg = 1; + int64_t result = 0, neg = 1, max = 922337203685477580 /* INT64_MAX / 10 */; size_t i = 0; while (i < str.len && (str.ptr[i] == ' ' || str.ptr[i] == '\t')) i++; if (i < str.len && str.ptr[i] == '-') neg = -1, i++; while (i < str.len && str.ptr[i] >= '0' && str.ptr[i] <= '9') { + if (result > max) return 0; result *= 10; result += (str.ptr[i] - '0'); i++;