diff options
author | Tor Andersson <tor.andersson@artifex.com> | 2021-07-01 13:24:42 +0200 |
---|---|---|
committer | Tor Andersson <tor.andersson@artifex.com> | 2021-07-01 13:24:42 +0200 |
commit | f5fca599023b7d13b84d237a7b61c2664bcda88d (patch) | |
tree | 0a6ce649ef50fc220c7ac7ad939b78b6b4360532 /platform/x11 | |
parent | 01f126052994bec17e286019e9bc76726d4b5255 (diff) |
Bug 703939: mupdf-curl: Check buffer size before accepting remote data.
Thanks to Nicolaas for the report and patch.
Diffstat (limited to 'platform/x11')
-rw-r--r-- | platform/x11/curl_stream.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/platform/x11/curl_stream.c b/platform/x11/curl_stream.c index 60dc76319..41a41df27 100644 --- a/platform/x11/curl_stream.c +++ b/platform/x11/curl_stream.c @@ -126,13 +126,13 @@ static size_t on_curl_header(void *ptr, size_t size, size_t nmemb, void *state_) struct curlstate *state = state_; lock(state); - if (strncmp(ptr, "Accept-Ranges: bytes", 20) == 0) + if (strncasecmp(ptr, "Accept-Ranges: bytes", 20) == 0) { DEBUG_MESSAGE(("header arrived with Accept-Ranges!\n")); state->accept_ranges = 1; } - if (strncmp(ptr, "Content-Length:", 15) == 0) + if (strncasecmp(ptr, "Content-Length:", 15) == 0) { char *s = ptr; state->content_length = fz_atoi(s + 15); @@ -222,6 +222,10 @@ static size_t on_curl_data(void *ptr, size_t size, size_t nmemb, void *state_) * code this to allow for curl calling us to copy smaller blocks * as they arrive. */ old_start = state->current_fill_start; + if (state->current_fill_start + size > state->buffer_max) { + unlock(state); + return 0; + } memcpy(state->buffer + state->current_fill_start, ptr, size); state->current_fill_start += size; /* If we've reached the end, or at least a different block |