[GNUnet-SVN] [gnurl] 227/256: file_range: avoid integer overflow when figuring out byte range

[gnunet]

This is an automated email from the git hooks/post-receive script.

ng0 pushed a commit to branch master
in repository gnurl.

commit afbdc96638a769d9bee8579d8b70f54537f5e891
Author: Daniel Stenberg <address@hidden>
AuthorDate: Fri Sep 22 14:24:39 2017 +0200

    file_range: avoid integer overflow when figuring out byte range
    
    When trying to bump the value with one and the value is already at max,
    it causes an integer overflow.
    
    Closes #1908
    Detected by oss-fuzz:
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3465
    
    Assisted-by: Max Dymond
---
 lib/file.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/file.c b/lib/file.c
index 82c576f38..7cfdab19f 100644
--- a/lib/file.c
+++ b/lib/file.c
@@ -165,6 +165,9 @@ static CURLcode file_range(struct connectdata *conn)
     else {
       /* X-Y */
       totalsize = to-from;
+      if(totalsize == CURL_OFF_T_MAX)
+        /* this is too big to increase, so bail out */
+        return CURLE_RANGE_ERROR;
       data->req.maxdownload = totalsize + 1; /* include last byte */
       data->state.resume_from = from;
       DEBUGF(infof(data, "RANGE from %" CURL_FORMAT_CURL_OFF_T

-- 
To stop receiving notification emails like this one, please contact
address@hidden