diff options
| author | Timo Teräs <timo.teras@iki.fi> | 2021-07-16 10:54:08 +0300 |
|---|---|---|
| committer | Timo Teräs <timo.teras@iki.fi> | 2021-07-26 14:43:35 +0300 |
| commit | 36048e8fef019c5be938f8a688845b6eef1d46ab (patch) | |
| tree | 0aa34f757463289276b3ccacc5395fdc5decca85 /libfetch/common.c | |
| parent | 41a6e4c247e68e906bea1ca7c31f0e8d3b49bc83 (diff) | |
| download | apk-tools-36048e8fef019c5be938f8a688845b6eef1d46ab.tar.gz apk-tools-36048e8fef019c5be938f8a688845b6eef1d46ab.tar.bz2 apk-tools-36048e8fef019c5be938f8a688845b6eef1d46ab.tar.xz apk-tools-36048e8fef019c5be938f8a688845b6eef1d46ab.zip | |
libfetch: fix range checking for http/ftp protocol parsing
Various parsing of numeric strings were not having adequate range
checking causing information leak or potential crash.
CVE-2021-36159
fixes #10749
Co-authored-by: Ariadne Conill <ariadne@dereferenced.org>
Reported-by: Samanta Navarro <ferivoz@riseup.net>
Diffstat (limited to 'libfetch/common.c')
| -rw-r--r-- | libfetch/common.c | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/libfetch/common.c b/libfetch/common.c index e91b0c6..0a51c26 100644 --- a/libfetch/common.c +++ b/libfetch/common.c @@ -171,6 +171,30 @@ fetch_info(const char *fmt, ...) /*** Network-related utility functions ***************************************/ +uintmax_t +fetch_parseuint(const char *str, const char **endptr, int radix, uintmax_t max) +{ + uintmax_t val = 0, maxx = max / radix, d; + const char *p; + + for (p = str; isxdigit((unsigned char)*p); p++) { + unsigned char ch = (unsigned char)*p; + if (isdigit(ch)) + d = ch - '0'; + else d = tolower(ch - 'a'); + if (d > radix || val > maxx) goto err; + val *= radix; + if (val > max-d) goto err; + val += d; + } + if (p == str || val > max) goto err; + *endptr = p; + return val; +err: + *endptr = "\xff"; + return 0; +} + /* * Return the default port for a scheme */ |