Slice filter: overflow protection in slice range requests

When the byte range is passed in the client Range header, the range
start is accepted up to NGX_MAX_OFF_T_VALUE, while
ngx_http_slice_range_variable() adds the slice size to it when
formatting the slice end.  With start values close to the maximum
this overflowed.

Now such range starts are ignored, similarly to other ranges not
handled by ngx_http_slice_get_start().

diff --git a/src/http/modules/ngx_http_slice_filter_module.c b/src/http/modules/ngx_http_slice_filter_module.c
index 67dc14c8249d2b98fd09d3709b03fe9314a9af6a..97f808ee54905111fcda9a15e60b8a57e58199e6 100644 (file)
--- a/src/http/modules/ngx_http_slice_filter_module.c
+++ b/src/http/modules/ngx_http_slice_filter_module.c
@@ -428,6 +428,10 @@ ngx_http_slice_range_variable(ngx_http_request_t *r,
 
         ctx->start = slcf->size * (ngx_http_slice_get_start(r) / slcf->size);
 
+        if (ctx->start > NGX_MAX_OFF_T_VALUE - (off_t) slcf->size) {
+            ctx->start = 0;
+        }
+
         ctx->range.data = p;
         ctx->range.len = ngx_sprintf(p, "bytes=%O-%O", ctx->start,
                                      ctx->start + (off_t) slcf->size - 1)