ソースを参照

Abort early on a bad content length

Signed-off-by: Yehuda Sadeh <yehuda@redhat.com>
Yehuda Sadeh 11 年 前
コミット
3b586462f4
1 ファイル変更7 行追加1 行削除
  1. 7 1
      src/civetweb.c

+ 7 - 1
src/civetweb.c

@@ -7082,7 +7082,13 @@ static int getreq(struct mg_connection *conn, char *ebuf, size_t ebuf_len, int t
         /* Message is a valid request or response */
         if ((cl = get_header(&conn->request_info, "Content-Length")) != NULL) {
             /* Request/response has content length set */
-            conn->content_len = strtoll(cl, NULL, 10);
+            char *endptr;
+            conn->content_len = strtoll(cl, &endptr, 10);
+            if (endptr == cl) {
+                snprintf(ebuf, ebuf_len, "%s", "Bad Request");
+                *err = 400;
+                return 0;
+            }
             /* Publish the content length back to the request info. */
             conn->request_info.content_length = conn->content_len;
         } else if (!mg_strcasecmp(conn->request_info.request_method, "POST") ||