From 8c9cc221d6e22549a927e54d1c0f4bce3a05c90f Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Tue, 12 Oct 2004 18:39:32 +0000 Subject: [PATCH] Backport fix for remote-crash bug svn:r2448 --- branches/tor-0_0_8-patches/src/or/buffers.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/branches/tor-0_0_8-patches/src/or/buffers.c b/branches/tor-0_0_8-patches/src/or/buffers.c index 7d5153ad5e..89dc0fc6b0 100644 --- a/branches/tor-0_0_8-patches/src/or/buffers.c +++ b/branches/tor-0_0_8-patches/src/or/buffers.c @@ -381,6 +381,10 @@ int fetch_from_buf_http(buf_t *buf, p = strstr(headers, CONTENT_LENGTH); if (p) { contentlen = atoi(p+strlen(CONTENT_LENGTH)); + if (contentlen < 0) { + log_fn(LOG_WARN, "Content-Length is less than zero; it looks like someone is trying to crash us."); + return -1; + } /* if content-length is malformed, then our body length is 0. fine. */ log_fn(LOG_DEBUG,"Got a contentlen of %d.",contentlen); if(bodylen < contentlen) {