Skip to content

Commit 550c60d

Browse files
committed
[bitreq] Use saturating_add for chunked content-length accumulation
Use saturating_add instead of += when accumulating content_length in chunked transfer encoding. This prevents integer overflow on 32-bit systems where a malicious server could send chunk sizes that cause the accumulated length to wrap around. Co-Authored-By: Claude AI
1 parent 7c219c5 commit 550c60d

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

bitreq/src/response.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -554,7 +554,7 @@ macro_rules! define_read_methods {
554554
return None;
555555
}
556556
*chunk_length = incoming_length;
557-
*content_length += incoming_length;
557+
*content_length = content_length.saturating_add(incoming_length);
558558
}
559559

560560
if *chunk_length > 0 {

0 commit comments

Comments
 (0)