From: Major_Tom <9447735+MajorTomSec@users.noreply.github.com>
Date: Wed, 13 May 2020 19:41:27 +0000 (+0200)
Subject: vauth/cleartext: fix theoretical integer overflow
X-Git-Tag: curl-7_71_0~154
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8e762199b094cd77fcd636fee2c503a5b00d0d2e;p=thirdparty%2Fcurl.git

vauth/cleartext: fix theoretical integer overflow

Fix theoretical integer overflow in Curl_auth_create_plain_message.

The security impact of the overflow was discussed on hackerone. We
agreed this is more of a theoretical vulnerability, as the integer
overflow would only be triggerable on systems using 32-bits size_t with
over 4GB of available memory space for the process.

Closes #5391
---

diff --git a/lib/vauth/cleartext.c b/lib/vauth/cleartext.c
index 6f452c1694..001f6ea9a9 100644
--- a/lib/vauth/cleartext.c
+++ b/lib/vauth/cleartext.c
@@ -81,7 +81,8 @@ CURLcode Curl_auth_create_plain_message(struct Curl_easy *data,
   plen = strlen(passwd);
 
   /* Compute binary message length. Check for overflows. */
-  if(((zlen + clen) > SIZE_T_MAX/4) || (plen > (SIZE_T_MAX/2 - 2)))
+  if((zlen > SIZE_T_MAX/4) || (clen > SIZE_T_MAX/4) ||
+     (plen > (SIZE_T_MAX/2 - 2)))
     return CURLE_OUT_OF_MEMORY;
   plainlen = zlen + clen + plen + 2;