Make sure iContentLength doesn't wrap around due to malformed packets

facchinm · facchinm · commit 1a3fb989a5d9 · 2024-05-08T17:25:48.000+02:00
diff --git a/src/HttpClient.cpp b/src/HttpClient.cpp
@@ -819,7 +819,11 @@ int HttpClient::readHeader()
     case eReadingContentLength:
         if (isdigit(c))
         {
-            iContentLength = iContentLength*10 + (c - '0');
+            long _iContentLength = iContentLength*10 + (c - '0');
+            // Only apply if the value didn't wrap around
+            if (_iContentLength > iContentLength) {
+                iContentLength = _iContentLength;
+            }
         }
         else
         {

Original file line number	Diff line number	Diff line change
`@@ -819,7 +819,11 @@ int HttpClient::readHeader()`
`819`	`819`	`case eReadingContentLength:`
`820`	`820`	`if (isdigit(c))`
`821`	`821`	`{`
`822`		`- iContentLength = iContentLength*10 + (c - '0');`
	`822`	`+ long _iContentLength = iContentLength*10 + (c - '0');`
	`823`	`+ // Only apply if the value didn't wrap around`
	`824`	`+ if (_iContentLength > iContentLength) {`
	`825`	`+ iContentLength = _iContentLength;`
	`826`	`+ }`
`823`	`827`	`}`
`824`	`828`	`else`
`825`	`829`	`{`