diff options
author | Rimas Misevičius <rmisev3@gmail.com> | 2017-10-02 22:18:06 +0300 |
---|---|---|
committer | Timothy Gu <timothygu99@gmail.com> | 2017-10-10 18:13:19 +0300 |
commit | 92146e00fd74890ec0e977c8f9592ddaae0314d4 (patch) | |
tree | 4c4c6225da27e99c08a5500b0d9d5587eb55d72c /src/node_url.cc | |
parent | 85a5a2c228594005280d4b7cd70741eae575a490 (diff) |
url: fix port overflow checking
This patch adds (port > 0xffff) check after each digit in the loop and
prevents integer overflow.
PR-URL: https://github.com/nodejs/node/pull/15794
Refs: https://github.com/w3c/web-platform-tests/pull/7602
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>
Reviewed-By: Timothy Gu <timothygu99@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Diffstat (limited to 'src/node_url.cc')
-rw-r--r-- | src/node_url.cc | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/src/node_url.cc b/src/node_url.cc index 3dd89d74833..e7a0b47194e 100644 --- a/src/node_url.cc +++ b/src/node_url.cc @@ -1597,10 +1597,11 @@ void URL::Parse(const char* input, ch == '#' || special_back_slash) { if (buffer.size() > 0) { - int port = 0; - for (size_t i = 0; i < buffer.size(); i++) + unsigned port = 0; + // the condition port <= 0xffff prevents integer overflow + for (size_t i = 0; port <= 0xffff && i < buffer.size(); i++) port = port * 10 + buffer[i] - '0'; - if (port < 0 || port > 0xffff) { + if (port > 0xffff) { // TODO(TimothyGu): This hack is currently needed for the host // setter since it needs access to hostname if it is valid, and // if the FAILED flag is set the entire response to JS layer @@ -1611,7 +1612,8 @@ void URL::Parse(const char* input, url->flags |= URL_FLAGS_FAILED; return; } - url->port = NormalizePort(url->scheme, port); + // the port is valid + url->port = NormalizePort(url->scheme, static_cast<int>(port)); buffer.clear(); } else if (has_state_override) { // TODO(TimothyGu): Similar case as above. |