diff options
| author | Timo Teräs <timo.teras@iki.fi> | 2021-07-16 10:54:08 +0300 |
|---|---|---|
| committer | Timo Teräs <timo.teras@iki.fi> | 2021-07-26 14:43:14 +0300 |
| commit | ca1d975e5eae662cfde085338e2e29f8e6fcf64b (patch) | |
| tree | 5cbfdf287c45c0d472ddce0d0dcf7201c0bbad80 /libfetch/common.c | |
| parent | 003e7135024b08b6f29ba83935b468c8f0b41ad4 (diff) | |
| download | apk-tools-ca1d975e5eae662cfde085338e2e29f8e6fcf64b.tar.gz apk-tools-ca1d975e5eae662cfde085338e2e29f8e6fcf64b.tar.bz2 apk-tools-ca1d975e5eae662cfde085338e2e29f8e6fcf64b.tar.xz apk-tools-ca1d975e5eae662cfde085338e2e29f8e6fcf64b.zip | |
libfetch: fix range checking for http/ftp protocol parsing
Various parsing of numeric strings were not having adequate range
checking causing information leak or potential crash.
CVE-2021-36159
fixes #10749
Co-authored-by: Ariadne Conill <ariadne@dereferenced.org>
Reported-by: Samanta Navarro <ferivoz@riseup.net>
Diffstat (limited to 'libfetch/common.c')
| -rw-r--r-- | libfetch/common.c | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/libfetch/common.c b/libfetch/common.c index bcba889..01c5f2b 100644 --- a/libfetch/common.c +++ b/libfetch/common.c @@ -171,6 +171,30 @@ fetch_info(const char *fmt, ...) /*** Network-related utility functions ***************************************/ +uintmax_t +fetch_parseuint(const char *str, const char **endptr, int radix, uintmax_t max) +{ + uintmax_t val = 0, maxx = max / radix, d; + const char *p; + + for (p = str; isxdigit((unsigned char)*p); p++) { + unsigned char ch = (unsigned char)*p; + if (isdigit(ch)) + d = ch - '0'; + else d = tolower(ch - 'a'); + if (d > radix || val > maxx) goto err; + val *= radix; + if (val > max-d) goto err; + val += d; + } + if (p == str || val > max) goto err; + *endptr = p; + return val; +err: + *endptr = "\xff"; + return 0; +} + /* * Return the default port for a scheme */ |