45 lines
1.3 KiB
Diff
45 lines
1.3 KiB
Diff
diff --git a/server/apreq_parser_header.c b/server/apreq_parser_header.c
|
|
index 19588be..7067e58 100644
|
|
--- a/server/apreq_parser_header.c
|
|
+++ b/server/apreq_parser_header.c
|
|
@@ -89,7 +89,7 @@ static apr_status_t split_header_line(apreq_param_t **p,
|
|
if (s != APR_SUCCESS)
|
|
return s;
|
|
|
|
- assert(nlen >= len);
|
|
+ if (!(nlen >= len)) { return APR_EBADARG; } assert(nlen >= len);
|
|
end->iov_len = len;
|
|
nlen -= len;
|
|
|
|
@@ -103,13 +103,13 @@ static apr_status_t split_header_line(apreq_param_t **p,
|
|
if (s != APR_SUCCESS)
|
|
return s;
|
|
|
|
- assert(glen >= dlen);
|
|
+ if (!(glen >= dlen)) { return APR_EBADARG; } assert(glen >= dlen);
|
|
glen -= dlen;
|
|
e = APR_BUCKET_NEXT(e);
|
|
}
|
|
|
|
/* copy value */
|
|
- assert(vlen > 0);
|
|
+ if (!(vlen > 0)) { return APR_EBADARG; } assert(vlen > 0);
|
|
dest = v->data;
|
|
while (vlen > 0) {
|
|
|
|
@@ -119,12 +119,12 @@ static apr_status_t split_header_line(apreq_param_t **p,
|
|
|
|
memcpy(dest, data, dlen);
|
|
dest += dlen;
|
|
- assert(vlen >= dlen);
|
|
+ if (!(vlen >= dlen)) { return APR_EBADARG; } assert(vlen >= dlen);
|
|
vlen -= dlen;
|
|
e = APR_BUCKET_NEXT(e);
|
|
}
|
|
|
|
- assert(dest[-1] == '\n');
|
|
+ if (!(dest[-1] == '\n')) { return APR_EBADARG; } assert(dest[-1] == '\n');
|
|
|
|
if (dest[-2] == '\r')
|
|
--dest;
|