From a123fb5113d6816320488f3239b6ae48b489ee9c Mon Sep 17 00:00:00 2001 From: Fabian Keil Date: Wed, 31 Mar 2021 12:14:36 +0200 Subject: [PATCH] remove_chunked_transfer_coding(): Refuse to de-chunk invalid data Previously the data could get corrupted even further. Now we simply pass the unmodified data to the client. --- filters.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/filters.c b/filters.c index baaaea5f..21ee44d5 100644 --- a/filters.c +++ b/filters.c @@ -2317,6 +2317,18 @@ static jb_err remove_chunked_transfer_coding(char *buffer, size_t *size) assert(buffer); from_p = to_p = buffer; +#ifndef FUZZ + /* + * Refuse to de-chunk invalid or incomplete data unless we're fuzzing. + */ + if (!chunked_data_is_complete(buffer, *size, 0)) + { + log_error(LOG_LEVEL_ERROR, + "Chunk-encoding appears to be invalid. Content can't be filtered."); + return JB_ERR_PARSE; + } +#endif + if (sscanf(buffer, "%x", &chunksize) != 1) { log_error(LOG_LEVEL_ERROR, "Invalid first chunksize while stripping \"chunked\" transfer coding"); -- 2.39.2