joyent/http-parser — pull request #76 by scunningham (2012-01-21 18:56:13+00:00)
Title: Check for overflow attack on content_length.

Naughty stuff happens in the parser if an attacker specifies a content-length greater than the max value allowed by int64_t.

1) If content-length in a header is set to LLONG_MAX+1, parser drops into s_body_identity_eof, which is not technically correct.

2) If content-length in the header is set to ULLONG_MAX, the parser decides there is a new message (line 1600), and will break on subsequent body data.

Neither of these are necessarily insecure in and of themselves and obviously unusual, but I would expect a savvy attacker might make use of this, particularly depending on how the parser was being used (say, as in an http proxy).

If overflow values are used in chunk headers, the situation is worse.

1) If LLONG_MAX+1 is used in a chunk header and NDEBUG is not defined, an assertion will fail and the app will abort (by default).

2) If LLONG_MAX+1 is used in a chunk header and NDEBUG is defined, the math gets funky, and the pointer 'p' gets incremented to point to a bad memory address, possibly causing a 'EXC_BAD_ACCESS' segfault.

I've added a couple simple checks on calculating content_length to error out on the overflow case. There's probably a more clever and/or efficient way to do this, but this test has the quality of being straight forward and understandable.