From 57d3d0f3919115b77761ae26af4ff40140fb7f98 Mon Sep 17 00:00:00 2001
From: Miklos Vajna <vmiklos@collabora.com>
Date: Wed, 7 Jul 2021 11:54:34 +0200
Subject: [PATCH] http response: check if result would fit into chunkLen

Signed-off-by: Miklos Vajna <vmiklos@collabora.com>
Change-Id: I6e3b73461653d2ab3cedaa3f6ca7fbfd2a826edb
---
 ...crash-fd5521adc1d02a7232343401c8bc9ad881d14847 | Bin 0 -> 194 bytes
 net/HttpRequest.cpp                               |   5 +++++
 2 files changed, 5 insertions(+)
 create mode 100644 fuzzer/httpresponse-data/crash-fd5521adc1d02a7232343401c8bc9ad881d14847

diff --git a/fuzzer/httpresponse-data/crash-fd5521adc1d02a7232343401c8bc9ad881d14847 b/fuzzer/httpresponse-data/crash-fd5521adc1d02a7232343401c8bc9ad881d14847
new file mode 100644
index 0000000000000000000000000000000000000000..e28f3d49f2c7913407835ae06061983c2e62c9e1
GIT binary patch
literal 194
zcmeYW2?@|Q)H6^pvM|tPNKLQ`mdGtg^;okxK;K-!$e=3DgDa#cF|Rl+wMf@BFF8LY
zGcVmLIioZ$J2i#N*47>YY`J*3OpEO8JwPTJ=-J!b+5$~A0MQ^t5P}QHI`2XaV9(11
GF&O~J)-<C4

literal 0
HcmV?d00001

diff --git a/net/HttpRequest.cpp b/net/HttpRequest.cpp
index 9f5d0dc30b..0eceaedc09 100644
--- a/net/HttpRequest.cpp
+++ b/net/HttpRequest.cpp
@@ -553,6 +553,11 @@ int64_t Response::readData(const char* p, int64_t len)
                     if (digit < 0)
                         break;
 
+                    if (chunkLen >= (std::numeric_limits<int64_t>::max() - digit) / 16)
+                    {
+                        // Would not fit into chunkLen.
+                        return len - available;
+                    }
                     chunkLen = chunkLen * 16 + digit;
                 }