Fix #2552 - reject requests with invalid/absent chunk length

This commit is contained in:
Sergey Lyubka committed 2024-01-20 09:35:01 +00:00
1 parent f883504d2d
commit 6b0e4a425d
3 files changed
+21 -3

No files matched your search

+1
View File
@@ -3159,6 +3159,7 @@ static int skip_chunk(const char *buf, int len, int *pl, int *dl) {
int i = 0, n = 0;
if (len < 3) return 0;
while (i < len && is_hex_digit(buf[i])) i++;
if (i == 0) return -1; // Error, no length specified
if (i > (int) sizeof(int) * 2) return -1; // Chunk length is too big
if (len < i + 1 || buf[i] != '\r' || buf[i + 1] != '\n') return -1; // Error
n = (int) mg_unhexn(buf, (size_t) i); // Decode chunk length