A large Content-Length header followed by a connection close could trigger an...

net/http/http_stream_parser.cc

 // Copyright (c) 2006-2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_stream_parser.h"
 
 #include "base/compiler_specific.h"
 #include "base/trace_event.h"
 #include "net/base/io_buffer.h"
 #include "net/http/http_request_info.h"
@@ skipping 66 matching lines @@
     user_callback_ = callback;
 
   return result > 0 ? OK : result;
 }
 
 int HttpStreamParser::ReadResponseBody(IOBuffer* buf, int buf_len,
                                       CompletionCallback* callback) {
   DCHECK(io_state_ == STATE_BODY_PENDING || io_state_ == STATE_DONE);
   DCHECK(!user_callback_);
   DCHECK(callback);
+  DCHECK_LE(buf_len, kMaxHeaderBufSize);
 
   if (io_state_ == STATE_DONE)
     return OK;
 
   user_read_buf_ = buf;
   user_read_buf_len_ = buf_len;
   io_state_ = STATE_READ_BODY;
 
   int result = DoLoop(OK);
   if (result == ERR_IO_PENDING)
@@ skipping 269 matching lines @@
     // Save the overflow data, which can be in two places.  There may be
     // some left over in |user_read_buf_|, plus there may be more
     // in |read_buf_|.  But the part left over in |user_read_buf_| must have
     // come from the |read_buf_|, so there's room to put it back at the
     // start first.
     int additional_save_amount = read_buf_->offset() - read_buf_unused_offset_;
     int save_amount = 0;
     if (chunked_decoder_.get()) {
       save_amount = chunked_decoder_->bytes_after_eof();
     } else if (response_body_length_ >= 0) {
-      save_amount = static_cast<int>(response_body_read_ -
-                                     response_body_length_);
-      if (save_amount < 0)
-        save_amount = 0;
-
-      if (result > 0)
-        result -= save_amount;
+      int64 extra_data_read = response_body_read_ - response_body_length_;
+      if (extra_data_read > 0) {
+        save_amount = static_cast<int>(extra_data_read);
+        if (result > 0)
+          result -= save_amount;
+      }
     }
 
+    CHECK(save_amount + additional_save_amount <= kMaxHeaderBufSize);
     if (read_buf_->capacity() < save_amount + additional_save_amount) {
       read_buf_->SetCapacity(save_amount + additional_save_amount);
     }
 
     if (save_amount) {
       memcpy(read_buf_->StartOfBuffer(), user_read_buf_->data() + result,
              save_amount);
     }
     read_buf_->set_offset(save_amount);
     if (additional_save_amount) {
@@ skipping 116 matching lines @@
 
 bool HttpStreamParser::CanFindEndOfResponse() const {
   return chunked_decoder_.get() || response_body_length_ >= 0;
 }
 
 bool HttpStreamParser::IsMoreDataBuffered() const {
   return read_buf_->offset() > read_buf_unused_offset_;
 }
 
 }  // namespace net