summaryrefslogtreecommitdiff
path: root/platform/x11
diff options
context:
space:
mode:
authorTor Andersson <tor.andersson@artifex.com>2021-07-01 13:24:42 +0200
committerTor Andersson <tor.andersson@artifex.com>2021-07-01 13:24:42 +0200
commitf5fca599023b7d13b84d237a7b61c2664bcda88d (patch)
tree0a6ce649ef50fc220c7ac7ad939b78b6b4360532 /platform/x11
parent01f126052994bec17e286019e9bc76726d4b5255 (diff)
Bug 703939: mupdf-curl: Check buffer size before accepting remote data.
Thanks to Nicolaas for the report and patch.
Diffstat (limited to 'platform/x11')
-rw-r--r--platform/x11/curl_stream.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/platform/x11/curl_stream.c b/platform/x11/curl_stream.c
index 60dc76319..41a41df27 100644
--- a/platform/x11/curl_stream.c
+++ b/platform/x11/curl_stream.c
@@ -126,13 +126,13 @@ static size_t on_curl_header(void *ptr, size_t size, size_t nmemb, void *state_)
struct curlstate *state = state_;
lock(state);
- if (strncmp(ptr, "Accept-Ranges: bytes", 20) == 0)
+ if (strncasecmp(ptr, "Accept-Ranges: bytes", 20) == 0)
{
DEBUG_MESSAGE(("header arrived with Accept-Ranges!\n"));
state->accept_ranges = 1;
}
- if (strncmp(ptr, "Content-Length:", 15) == 0)
+ if (strncasecmp(ptr, "Content-Length:", 15) == 0)
{
char *s = ptr;
state->content_length = fz_atoi(s + 15);
@@ -222,6 +222,10 @@ static size_t on_curl_data(void *ptr, size_t size, size_t nmemb, void *state_)
* code this to allow for curl calling us to copy smaller blocks
* as they arrive. */
old_start = state->current_fill_start;
+ if (state->current_fill_start + size > state->buffer_max) {
+ unlock(state);
+ return 0;
+ }
memcpy(state->buffer + state->current_fill_start, ptr, size);
state->current_fill_start += size;
/* If we've reached the end, or at least a different block