Add fix for remote-crash bug.

svn:r2447

diff --git a/src/or/buffers.c b/src/or/buffers.c
index 7d5153ad5e5f7b3260644ac8916b90b28b3cc1f2..89dc0fc6b06fd52ab41a9a84dd28fa4e8dda9ded 100644 (file)
--- a/src/or/buffers.c
+++ b/src/or/buffers.c
@@ -381,6 +381,10 @@ int fetch_from_buf_http(buf_t *buf,
   p = strstr(headers, CONTENT_LENGTH);
   if (p) {
     contentlen = atoi(p+strlen(CONTENT_LENGTH));
+    if (contentlen < 0) {
+      log_fn(LOG_WARN, "Content-Length is less than zero; it looks like someone is trying to crash us.");
+      return -1;
+    }
     /* if content-length is malformed, then our body length is 0. fine. */
     log_fn(LOG_DEBUG,"Got a contentlen of %d.",contentlen);
     if(bodylen < contentlen) {