Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(352)

Unified Diff: net/http/http_auth_handler_ntlm_portable.cc

Issue 2873673002: Add unit tests for NTLMv1 portable implementation (Closed)
Patch Set: Cleanup Created 3 years, 6 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: net/http/http_auth_handler_ntlm_portable.cc
diff --git a/net/http/http_auth_handler_ntlm_portable.cc b/net/http/http_auth_handler_ntlm_portable.cc
index bb65b308c05644250a3293be0e46ecd721376442..4f0204c249f72974899632c335719de7e71f74ed 100644
--- a/net/http/http_auth_handler_ntlm_portable.cc
+++ b/net/http/http_auth_handler_ntlm_portable.cc
@@ -365,11 +365,19 @@ static int ParseType2Msg(const void* in_buf, uint32_t in_len, Type2Msg* msg) {
uint32_t offset = ReadUint32(cursor); // get offset from in_buf
msg->target_len = 0;
msg->target = NULL;
- // Check the offset / length combo is in range of the input buffer, including
- // integer overflow checking.
- if (offset + target_len > offset && offset + target_len <= in_len) {
- msg->target_len = target_len;
- msg->target = ((const uint8_t*)in_buf) + offset;
+
+ // Target length 0 is valid and indicates no target information.
+ if (target_len != 0) {
+ // Check the offset / length combo is in range of the input buffer,
+ // including integer overflow checking.
+ if (offset + target_len > offset && offset + target_len <= in_len) {
+ msg->target_len = target_len;
+ msg->target = ((const uint8_t*)in_buf) + offset;
+ } else {
+ // Reject a message with a non-zero target length that
+ // would cause an overflow.
+ return ERR_UNEXPECTED;
+ }
}
// read flags

Powered by Google App Engine
This is Rietveld 408576698