From: Phil Carmody Date: Wed, 2 Jul 2014 15:21:24 +0000 (+0300) Subject: lib: uri-util - harden uri_parse_port against overflow X-Git-Tag: 2.2.14.rc1~311 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=601eea4261fc7aaf76328842e6c864f73fb308df;p=thirdparty%2Fdovecot%2Fcore.git lib: uri-util - harden uri_parse_port against overflow The invalid input 72817 (2^16*10/9) is parsed as a valid value. 7281 * 10 + 7 = 72817 == 7281 (mod 2^16), so the prev check fails. Signed-off-by: Phil Carmody --- diff --git a/src/lib/uri-util.c b/src/lib/uri-util.c index a69e581e53..ee8334805b 100644 --- a/src/lib/uri-util.c +++ b/src/lib/uri-util.c @@ -479,7 +479,7 @@ static int uri_parse_host(struct uri_parser *parser, struct uri_authority *auth) static int uri_parse_port(struct uri_parser *parser, struct uri_authority *auth) { - in_port_t port = 0; + unsigned long port = 0; int count = 0; /* RFC 3986: @@ -488,10 +488,8 @@ static int uri_parse_port(struct uri_parser *parser, struct uri_authority *auth) */ while (parser->cur < parser->end && i_isdigit(*parser->cur)) { - in_port_t prev = port; - - port = port * 10 + (in_port_t)(parser->cur[0] - '0'); - if (port < prev) { + port = port * 10 + (parser->cur[0] - '0'); + if (port > (in_port_t)-1) { parser->error = "Port number is too high"; return -1; }