github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-08-13 21:36:00 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3322 from airween/v3/validatebyterange

Browse Source 
fix: add value checking to @validateByteRange
This commit is contained in:
Ervin Hegedus 2025-01-06 19:16:49 +01:00 committed by GitHub
commit 9e685bf86d
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 17 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
src/operators/validate_byte_range.cc
View File

@ -37,6 +37,11 @@ bool ValidateByteRange::getRange(const std::string &rangeRepresentation,
"' into a number");
return false;
}
if ((start < 0) || (start > 255)) {
error->assign("Invalid byte value: " +
std::to_string(start));
return false;
}
table[start >> 3] = (table[start >> 3] | (1 << (start & 0x7)));
return true;
}
@ -87,21 +92,29 @@ bool ValidateByteRange::getRange(const std::string &rangeRepresentation,
bool ValidateByteRange::init(const std::string &file,
std::string *error) {
size_t pos = m_param.find_first_of(",");
bool rc;
if (pos == std::string::npos) {
getRange(m_param, error);
rc = getRange(m_param, error);
} else {
getRange(std::string(m_param, 0, pos), error);
rc = getRange(std::string(m_param, 0, pos), error);
}
if (rc == false) {
return false;
}
while (pos != std::string::npos) {
size_t next_pos = m_param.find_first_of(",", pos + 1);
if (next_pos == std::string::npos) {
getRange(std::string(m_param, pos + 1, m_param.length() -
rc = getRange(std::string(m_param, pos + 1, m_param.length() -
(pos + 1)), error);
} else {
getRange(std::string(m_param, pos + 1, next_pos - (pos + 1)), error);
rc = getRange(std::string(m_param, pos + 1, next_pos - (pos + 1)), error);
}
if (rc == false) {
return false;
}
pos = next_pos;
}