Fijxu
/
nginx-quic
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Core: overflow detection in ngx_parse_time() (ticket #732).

This commit is contained in:
Ruslan Ermilov 2015-03-17 00:26:20 +03:00
parent 3b5ef1b5c9
commit ad2d8f9939
1 changed files with 37 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
src/core/ngx_parse.c
View File

@ -103,7 +103,8 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
{ {
u_char *p, *last; u_char *p, *last;
ngx_int_t value, total, scale; ngx_int_t value, total, scale;
ngx_uint_t max, valid; ngx_int_t max, cutoff, cutlim;
ngx_uint_t valid;
enum { enum {
st_start = 0, st_start = 0,
st_year, st_year,
@ -120,6 +121,8 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
valid = 0; valid = 0;
value = 0; value = 0;
total = 0; total = 0;
cutoff = NGX_MAX_INT_T_VALUE / 10;
cutlim = NGX_MAX_INT_T_VALUE % 10;
step = is_sec ? st_start : st_month; step = is_sec ? st_start : st_month;
p = line->data; p = line->data;
@ -128,6 +131,10 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
while (p < last) { while (p < last) {
if (*p >= '0' && *p <= '9') { if (*p >= '0' && *p <= '9') {
if (value >= cutoff && (value > cutoff || *p - '0' > cutlim)) {
return NGX_ERROR;
}
value = value * 10 + (*p++ - '0'); value = value * 10 + (*p++ - '0');
valid = 1; valid = 1;
continue; continue;
@ -140,7 +147,7 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
return NGX_ERROR; return NGX_ERROR;
} }
step = st_year; step = st_year;
max = NGX_MAX_INT32_VALUE / (60 * 60 * 24 * 365); max = NGX_MAX_INT_T_VALUE / (60 * 60 * 24 * 365);
scale = 60 * 60 * 24 * 365; scale = 60 * 60 * 24 * 365;
break; break;
@ -149,7 +156,7 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
return NGX_ERROR; return NGX_ERROR;
} }
step = st_month; step = st_month;
max = NGX_MAX_INT32_VALUE / (60 * 60 * 24 * 30); max = NGX_MAX_INT_T_VALUE / (60 * 60 * 24 * 30);
scale = 60 * 60 * 24 * 30; scale = 60 * 60 * 24 * 30;
break; break;
@ -158,7 +165,7 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
return NGX_ERROR; return NGX_ERROR;
} }
step = st_week; step = st_week;
max = NGX_MAX_INT32_VALUE / (60 * 60 * 24 * 7); max = NGX_MAX_INT_T_VALUE / (60 * 60 * 24 * 7);
scale = 60 * 60 * 24 * 7; scale = 60 * 60 * 24 * 7;
break; break;
@ -167,7 +174,7 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
return NGX_ERROR; return NGX_ERROR;
} }
step = st_day; step = st_day;
max = NGX_MAX_INT32_VALUE / (60 * 60 * 24); max = NGX_MAX_INT_T_VALUE / (60 * 60 * 24);
scale = 60 * 60 * 24; scale = 60 * 60 * 24;
break; break;
@ -176,7 +183,7 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
return NGX_ERROR; return NGX_ERROR;
} }
step = st_hour; step = st_hour;
max = NGX_MAX_INT32_VALUE / (60 * 60); max = NGX_MAX_INT_T_VALUE / (60 * 60);
scale = 60 * 60; scale = 60 * 60;
break; break;
@ -187,7 +194,7 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
} }
p++; p++;
step = st_msec; step = st_msec;
max = NGX_MAX_INT32_VALUE; max = NGX_MAX_INT_T_VALUE;
scale = 1; scale = 1;
break; break;
} }
@ -196,7 +203,7 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
return NGX_ERROR; return NGX_ERROR;
} }
step = st_min; step = st_min;
max = NGX_MAX_INT32_VALUE / 60; max = NGX_MAX_INT_T_VALUE / 60;
scale = 60; scale = 60;
break; break;
@ -205,7 +212,7 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
return NGX_ERROR; return NGX_ERROR;
} }
step = st_sec; step = st_sec;
max = NGX_MAX_INT32_VALUE; max = NGX_MAX_INT_T_VALUE;
scale = 1; scale = 1;
break; break;
@ -214,7 +221,7 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
return NGX_ERROR; return NGX_ERROR;
} }
step = st_last; step = st_last;
max = NGX_MAX_INT32_VALUE; max = NGX_MAX_INT_T_VALUE;
scale = 1; scale = 1;
break; break;
@ -227,16 +234,18 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
max /= 1000; max /= 1000;
} }
if ((ngx_uint_t) value > max) { if (value > max) {
return NGX_ERROR; return NGX_ERROR;
} }
total += value * scale; value *= scale;
if ((ngx_uint_t) total > NGX_MAX_INT32_VALUE) { if (total > NGX_MAX_INT_T_VALUE - value) {
return NGX_ERROR; return NGX_ERROR;
} }
total += value;
value = 0; value = 0;
while (p < last && *p == ' ') { while (p < last && *p == ' ') {
@ -244,9 +253,21 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
} }
} }
if (valid) { if (!valid) {
return total + value * (is_sec ? 1 : 1000); return NGX_ERROR;
} }
return NGX_ERROR; if (!is_sec) {
if (value > NGX_MAX_INT_T_VALUE / 1000) {
return NGX_ERROR;
}
value *= 1000;
}
if (total > NGX_MAX_INT_T_VALUE - value) {
return NGX_ERROR;
}
return total + value;
} }