Parsing of Content-Disposition relies on well formed headers. A malformed header such as:
Content-Disposition=""; will result in a strnduppayload->content_disp_name, -1, ptr), which will copy memory until it hits a \0. Prevent this by only copying the value if it exists. Fixes FS#73704. Signed-off-by: Allan McRae <[email protected]> --- lib/libalpm/dload.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/lib/libalpm/dload.c b/lib/libalpm/dload.c index a64f405f..7c27c3ea 100644 --- a/lib/libalpm/dload.c +++ b/lib/libalpm/dload.c @@ -295,8 +295,11 @@ static size_t dload_parseheader_cb(void *ptr, size_t size, size_t nmemb, void *u endptr--; } - STRNDUP(payload->content_disp_name, fptr, endptr - fptr + 1, - RET_ERR(payload->handle, ALPM_ERR_MEMORY, realsize)); + /* avoid information leakage with badly formed headers */ + if(endptr > fptr) { + STRNDUP(payload->content_disp_name, fptr, endptr - fptr + 1, + RET_ERR(payload->handle, ALPM_ERR_MEMORY, realsize)); + } } } -- 2.35.1
