Skip to content

Commit f5e9a67

Browse files
committed
fix: add bounds check for negative reserved in resize_buf
Prevent integer overflow when reserved < 0 is passed to resize_buf(), which would cause (size_t)reserved to become a very large value.
1 parent f9bae97 commit f5e9a67

1 file changed

Lines changed: 1 addition & 0 deletions

File tree

http/server/FileCacheEx.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,7 @@ typedef struct file_cache_ex_s {
7373

7474
// NOTE: caller must hold mutex — invalidates filebuf/httpbuf pointers
7575
void resize_buf(size_t filesize, int reserved) {
76+
if (reserved < 0) reserved = 0;
7677
header_reserve = reserved;
7778
buf.resize((size_t)reserved + filesize);
7879
filebuf.base = buf.base + reserved;

0 commit comments

Comments
 (0)