[Fix] html: correct image style dimension parsing

The style dimension parser found a digit but called rspamd_strtoul from
the start of the substring, ignored its return value, and assigned the
result. For substrings longer than 22 chars rspamd_strtoul returns
before writing *value, leaving img->height/width set from an
uninitialized variable; shorter CSS parsed to zero because the substring
began with ':' or whitespace.

Parse the digit run starting at the located digit, bound the length to
that run, and only assign on a successful parse.

diff --git a/src/libserver/html/html.cxx b/src/libserver/html/html.cxx
index 7af38a9763485bad7b3cd9f4f15b3355acf73592..86972766fbd9370ba55c0a01f96d5011275d62ee 100644 (file)
--- a/src/libserver/html/html.cxx
+++ b/src/libserver/html/html.cxx
@@ -1687,10 +1687,17 @@ html_process_img_tag(rspamd_mempool_t *pool,
                                for (auto i = 0; i < substr.size(); i++) {
                                        auto t = substr[i];
                                        if (g_ascii_isdigit(t)) {
+                                               /* Parse the digit run starting at this position */
+                                               auto digit_end = i;
+                                               while (digit_end < substr.size() &&
+                                                          g_ascii_isdigit(substr[digit_end])) {
+                                                       digit_end++;
+                                               }
                                                unsigned long val;
-                                               rspamd_strtoul(substr.data(),
-                                                                          substr.size(), &val);
-                                               img->height = val;
+                                               if (rspamd_strtoul(substr.data() + i,
+                                                                                  digit_end - i, &val)) {
+                                                       img->height = val;
+                                               }
                                                break;
                                        }
                                        else if (!g_ascii_isspace(t) && t != '=' && t != ':') {
@@ -1710,10 +1717,17 @@ html_process_img_tag(rspamd_mempool_t *pool,
                                for (auto i = 0; i < substr.size(); i++) {
                                        auto t = substr[i];
                                        if (g_ascii_isdigit(t)) {
+                                               /* Parse the digit run starting at this position */
+                                               auto digit_end = i;
+                                               while (digit_end < substr.size() &&
+                                                          g_ascii_isdigit(substr[digit_end])) {
+                                                       digit_end++;
+                                               }
                                                unsigned long val;
-                                               rspamd_strtoul(substr.data(),
-                                                                          substr.size(), &val);
-                                               img->width = val;
+                                               if (rspamd_strtoul(substr.data() + i,
+                                                                                  digit_end - i, &val)) {
+                                                       img->width = val;
+                                               }
                                                break;
                                        }
                                        else if (!g_ascii_isspace(t) && t != '=' && t != ':') {