mirrors/netsurf
1
0
Fork 0
mirror of https://github.com/netsurf-browser/netsurf synced 2025-03-05 14:51:47 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix a signed comparison error in nsurl parsing.

Browse Source 
In utils/nsurl.c the function nsurl__create_from_section() has a
section dealing with non-redundant ports (starting line 973).

lwc_intern_string() was being called with negative lengths and as it
takes a size_t (unsigned) so is getting passed a very large length
which causes a segfault.

this is supposed to be protected by the flag setting on line 969
however the arithmetic is all *unsigned* so the condition never
matches

(gdb) p length - (colon - pegs->at + skip)
$9 = 18446744073709551608

changing the check arithmetic to be a simple comparison against length
prevents this issue and reduces the amount of computation required.
This commit is contained in:
Vincent Sanders 2015-07-04 09:36:46 +01:00
parent 123c8bc8b3
commit ccac301176
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
utils/nsurl.c
View File

@ -963,7 +963,7 @@ static nserror nsurl__create_from_section(const char * const url_s,
flags |= NSURL_F_NO_PORT;
}
if (length - (colon - pegs->at + skip) <= 0) {
if (length <= (colon - pegs->at + skip)) {
/* No space for a port after the colon
*/
flags |= NSURL_F_NO_PORT;