fix: drop invalid chunk sizes
This commit is contained in:
@@ -331,7 +331,9 @@ void Proxy::handleClient(SOCKET clientSocket)
|
|||||||
{
|
{
|
||||||
size_t le = clientStream.buffer.find("\r\n", idx);
|
size_t le = clientStream.buffer.find("\r\n", idx);
|
||||||
if (le == std::string::npos) break;
|
if (le == std::string::npos) break;
|
||||||
int cs = stoiSafe(clientStream.buffer.substr(idx, le - idx), 0, 16);
|
int cs = stoiSafe(clientStream.buffer.substr(idx, le - idx), -1, 16);
|
||||||
|
if (cs < 0) return;
|
||||||
|
|
||||||
if (idx + (le - idx) + 2 + cs + 2 > clientStream.buffer.size()) break;
|
if (idx + (le - idx) + 2 + cs + 2 > clientStream.buffer.size()) break;
|
||||||
if (cs > 0) fullBody.append(clientStream.buffer, le + 2, cs);
|
if (cs > 0) fullBody.append(clientStream.buffer, le + 2, cs);
|
||||||
idx = le + 2 + cs + 2;
|
idx = le + 2 + cs + 2;
|
||||||
@@ -402,7 +404,9 @@ void Proxy::handleClient(SOCKET clientSocket)
|
|||||||
{
|
{
|
||||||
size_t le = serverStream.buffer.find("\r\n", idx);
|
size_t le = serverStream.buffer.find("\r\n", idx);
|
||||||
if (le == std::string::npos) break;
|
if (le == std::string::npos) break;
|
||||||
int cs = stoiSafe(serverStream.buffer.substr(idx, le - idx), 0, 16);
|
int cs = stoiSafe(serverStream.buffer.substr(idx, le - idx), -1, 16);
|
||||||
|
if (cs < 0) return;
|
||||||
|
|
||||||
if (idx + (le - idx) + 2 + cs + 2 > serverStream.buffer.size()) break;
|
if (idx + (le - idx) + 2 + cs + 2 > serverStream.buffer.size()) break;
|
||||||
if (cs > 0) fullBody.append(serverStream.buffer, le + 2, cs);
|
if (cs > 0) fullBody.append(serverStream.buffer, le + 2, cs);
|
||||||
idx = le + 2 + cs + 2;
|
idx = le + 2 + cs + 2;
|
||||||
|
|||||||
Reference in New Issue
Block a user