[GNUnet-SVN] [gnurl] 136/150: readwrite: make sure excess reads don't go beyond buffer end

[gnunet]

This is an automated email from the git hooks/post-receive script.

ng0 pushed a commit to branch master
in repository gnurl.

commit d52dc4760f6d9ca1937eefa2093058a952465128
Author: Daniel Stenberg <address@hidden>
AuthorDate: Thu Mar 8 10:33:16 2018 +0100

    readwrite: make sure excess reads don't go beyond buffer end
    
    CVE-2018-1000122
    Bug: https://curl.haxx.se/docs/adv_2018-b047.html
    
    Detected by OSS-fuzz
---
 lib/transfer.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/lib/transfer.c b/lib/transfer.c
index c46ac25f4..fd9af3155 100644
--- a/lib/transfer.c
+++ b/lib/transfer.c
@@ -808,10 +808,15 @@ static CURLcode readwrite_data(struct Curl_easy *data,
 
     } /* if(!header and data to read) */
 
-    if(conn->handler->readwrite &&
-       (excess > 0 && !conn->bits.stream_was_rewound)) {
+    if(conn->handler->readwrite && excess && !conn->bits.stream_was_rewound) {
       /* Parse the excess data */
       k->str += nread;
+
+      if(&k->str[excess] > &k->buf[data->set.buffer_size]) {
+        /* the excess amount was too excessive(!), make sure
+           it doesn't read out of buffer */
+        excess = &k->buf[data->set.buffer_size] - k->str;
+      }
       nread = (ssize_t)excess;
 
       result = conn->handler->readwrite(data, conn, &nread, &readmore);

-- 
To stop receiving notification emails like this one, please contact
address@hidden