From 74865d5d41f9d234625560ac1dd6d9863da27ac4 Mon Sep 17 00:00:00 2001 From: David Kalnischkies Date: Mon, 5 Mar 2012 00:19:50 +0100 Subject: [PATCH] ensure that (s)scanf doesn't parse a too long Code now that a previous commit lifted the Line-length limit --- methods/http.cc | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/methods/http.cc b/methods/http.cc index 7ddf8e04..7979af29 100644 --- a/methods/http.cc +++ b/methods/http.cc @@ -42,6 +42,7 @@ #include #include #include +#include #include #include @@ -557,7 +558,7 @@ bool ServerState::HeaderLine(string Line) // Evil servers return no version if (Line[4] == '/') { - int const elements = sscanf(Line.c_str(),"HTTP/%u.%u %u%[^\n]",&Major,&Minor,&Result,Code); + int const elements = sscanf(Line.c_str(),"HTTP/%3u.%3u %3u%359[^\n]",&Major,&Minor,&Result,Code); if (elements == 3) { Code[0] = '\0'; @@ -571,7 +572,7 @@ bool ServerState::HeaderLine(string Line) { Major = 0; Minor = 9; - if (sscanf(Line.c_str(),"HTTP %u%[^\n]",&Result,Code) != 2) + if (sscanf(Line.c_str(),"HTTP %3u%359[^\n]",&Result,Code) != 2) return _error->Error(_("The HTTP server sent an invalid reply header")); } @@ -599,9 +600,10 @@ bool ServerState::HeaderLine(string Line) // The length is already set from the Content-Range header if (StartPos != 0) return true; - - if (sscanf(Val.c_str(),"%llu",&Size) != 1) - return _error->Error(_("The HTTP server sent an invalid Content-Length header")); + + Size = strtoull(Val.c_str(), NULL, 10); + if (Size == ULLONG_MAX) + return _error->Errno("HeaderLine", _("The HTTP server sent an invalid Content-Length header")); return true; } -- 2.20.1