CVE-2018-19199: Integer Overflow or Wraparound (CWE-190)
value: An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery* or uriComposeQueryEx* function because of an unchecked multiplication.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2018-11-12T15:29Z
Repository: https://github.com/uriparser/uriparser
Language: Other
Files changed: ChangeLog, src/UriQuery.c
Commit date: 2018-09-23 21:30:39 +0200
Commit message: UriQuery.c: Catch integer overflow in ComposeQuery and ...Ex

Diff: diff --git a/ChangeLog b/ChangeLog
index 7c32d86..fae1ede 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,10 +2,12 @@
 
   * Fixed: Out-of-bounds write in uriComposeQuery* and uriComposeQueryEx*
       Thanks to Google Autofuzz team for the report!
   * Fixed: Fix off-by-one in uriComposeQueryCharsRequired* and ...Ex*
       Reported space requirements were 1 byte bigger than necessary
+  * Fixed: Detect integer overflow in uriComposeQuery* and uriComposeQueryEx*
+      Thanks to Google Autofuzz team for the report!
   * TODO BUMP SONAME
 
 2018-08-18 -- 0.8.6
 
   * Fixed: Bad/NULL .hostText.afterLast when parsing certain rather pathologic
diff --git a/src/UriQuery.c b/src/UriQuery.c
index 45acf5a..9165ec8 100644
--- a/src/UriQuery.c
+++ b/src/UriQuery.c
@@ -66,10 +66,14 @@
 # include "UriCommon.h"
 #endif
 
 
 
+#include <limits.h>
+
+
+
 static int URI_FUNC(ComposeQueryEngine)(URI_CHAR * dest,
 		const URI_TYPE(QueryList) * queryList,
 		int maxChars, int * charsWritten, int * charsRequired,
 		UriBool spaceToPlus, UriBool normalizeBreaks);
 
@@ -199,13 +203,19 @@ int URI_FUNC(ComposeQueryEngine)(URI_CHAR * dest,
 	while (queryList != NULL) {
 		const URI_CHAR * const key = queryList->key;
 		const URI_CHAR * const value = queryList->value;
 		const int worstCase = (normalizeBreaks == URI_TRUE ? 6 : 3);
 		const int keyLen = (key == NULL) ? 0 : (int)URI_STRLEN(key);
-		const int keyRequiredChars = worstCase * keyLen;
+		int keyRequiredChars;
 		const int valueLen = (value == NULL) ? 0 : (int)URI_STRLEN(value);
-		const int valueRequiredChars = worstCase * valueLen;
+		int valueRequiredChars;
+
+		if ((keyLen >= INT_MAX / worstCase) || (valueLen >= INT_MAX / worstCase)) {
+			return URI_ERROR_OUTPUT_TOO_LARGE;
+		}
+		keyRequiredChars = worstCase * keyLen;
+		valueRequiredChars = worstCase * valueLen;
 
 		if (dest == NULL) {
 			(*charsRequired) += ampersandLen + keyRequiredChars + ((value == NULL)
 						? 0
 						: 1 + valueRequiredChars);

Vulnerable code: 		const int keyRequiredChars = worstCase * keyLen;
		const int valueRequiredChars = worstCase * valueLen;
Fixed code:   * Fixed: Detect integer overflow in uriComposeQuery* and uriComposeQueryEx*
      Thanks to Google Autofuzz team for the report!
#include <limits.h>



		int keyRequiredChars;
		int valueRequiredChars;

		if ((keyLen >= INT_MAX / worstCase) || (valueLen >= INT_MAX / worstCase)) {
			return URI_ERROR_OUTPUT_TOO_LARGE;
		}
		keyRequiredChars = worstCase * keyLen;
		valueRequiredChars = worstCase * valueLen;