github-repos/wget
1
0
Fork 0
mirror of https://github.com/mirror/wget.git synced 2026-08-31 03:37:54 +08:00
Code Issues Packages Projects Releases Wiki Activity

Bugfix: Detect malformed base64 Metalink/HTTP Digest header

Browse Source 
* src/http.c (metalink_from_http): Fix hash_bin_len type. Use ssize_t
  instead than size_t. Reject -1 as base64_decode() return value
* testenv/Makefile.am: Add new file
* testenv/Test-metalink-http-baddigest.py: New file. Metalink/HTTP
  malformed base64 Digest header tests

On malformed base64 input, ssize_t base64_decode() returns -1. Such
value is too big for a size_t variable, and used as xmalloc() value
will exaust all the memory.
This commit is contained in:
Matthew White
2016-08-27 20:28:42 +02:00
parent 0538e791fb
commit 5dccb2a9ce
3 changed files with 105 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/http.c
View File

@@ -2894,10 +2894,18 @@ metalink_from_http (const struct response *resp, const struct http_stat *hs,
Therefore we convert: base64 -> binary -> hex. */
const size_t dig_hash_str_len = strlen (dig_hash);
char *bin_hash = alloca (dig_hash_str_len * 3 / 4 + 1);
size_t hash_bin_len;
ssize_t hash_bin_len;
hash_bin_len = base64_decode (dig_hash, bin_hash);
/* Detect malformed base64 input. */
if (hash_bin_len < 0)
{
xfree (dig_type);
xfree (dig_hash);
continue;
}
/* One slot for me, one for zero-termination. */
mfile->checksums =
xrealloc (mfile->checksums,
@@ -2905,8 +2913,8 @@ metalink_from_http (const struct response *resp, const struct http_stat *hs,
mfile->checksums[hash_count] = xnew (metalink_checksum_t);
mfile->checksums[hash_count]->type = dig_type;
mfile->checksums[hash_count]->hash = xmalloc (hash_bin_len * 2 + 1);
wg_hex_to_string (mfile->checksums[hash_count]->hash, bin_hash, hash_bin_len);
mfile->checksums[hash_count]->hash = xmalloc ((size_t)hash_bin_len * 2 + 1);
wg_hex_to_string (mfile->checksums[hash_count]->hash, bin_hash, (size_t)hash_bin_len);
xfree (dig_hash);