瀏覽代碼

Integer Underflow

fixed underflow in while loop if in_len is initially less than 4 bytes

Fix by @makrsmark, see #247,
https://github.com/makrsmark/civetweb/commit/bd125e478522a6795761ca042e3902f3708767bf
bel 9 年之前
父節點
當前提交
dd461c7724
共有 1 個文件被更改,包括 1 次插入1 次删除
  1. 1 1
      src/civetweb.c

+ 1 - 1
src/civetweb.c

@@ -8606,7 +8606,7 @@ mask_data(const char *in, size_t in_len, uint32_t masking_key, char *out)
 	size_t i = 0;
 
 	i = 0;
-	if (((ptrdiff_t)in % 4) == 0) {
+	if ((in_len > 3) && ((ptrdiff_t)in % 4) == 0) {
 		/* Convert in 32 bit words, if data is 4 byte aligned */
 		while (i < (in_len - 3)) {
 			*(uint32_t *)(void *)(out + i) =