Be strict about maxPayloadLength in inflate

2020-01-01 18:15:56 +01:00
parent 6fe5ea40aa
commit bbbe3bda18
2 changed files with 12 additions and 1 deletions
@@ -161,9 +161,20 @@ struct InflationStream {

        if (zlibContext->dynamicInflationBuffer.length()) {
            zlibContext->dynamicInflationBuffer.append(zlibContext->inflationBuffer, LARGE_BUFFER_SIZE - inflationStream.avail_out);
+
+            /* Let's be strict about the max size */
+            if (zlibContext->dynamicInflationBuffer.length() > maxPayloadLength) {
+                return {nullptr, 0};
+            }
+
            return {zlibContext->dynamicInflationBuffer.data(), zlibContext->dynamicInflationBuffer.length()};
        }

+        /* Let's be strict about the max size */
+        if ((LARGE_BUFFER_SIZE - inflationStream.avail_out) > maxPayloadLength) {
+            return {nullptr, 0};
+        }
+
        return {zlibContext->inflationBuffer, LARGE_BUFFER_SIZE - inflationStream.avail_out};
    }