[BUGFIX] replace assert() with RETURN_ERROR() to handle input data er…

…ror.
litespeedtech · Oct 27, 2021 · 0b33c64 · 0b33c64
1 parent e2bbfc4
commit 0b33c64
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 9 deletions.
diff --git a/LICENSE b/LICENSE
@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2018 - 2020 LiteSpeed Technologies Inc
+Copyright (c) 2018 - 2021 LiteSpeed Technologies Inc
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

diff --git a/lsqpack.c b/lsqpack.c
@@ -3653,7 +3653,8 @@ parse_header_data (struct lsqpack_dec *dec,
             break;
         case DATA_STATE_READ_VAL_HUFFMAN:
             size = MIN((unsigned) (end - buf), DATA.left);
-            assert(size);
+            if (size == 0)
+                RETURN_ERROR();
             dst = get_dst(dec, read_ctx, &dst_size);
             hdr = lsqpack_huff_decode(buf, size, dst, dst_size,
                     &DATA.dec_huff_state, DATA.left == size);
@@ -3686,9 +3687,11 @@ parse_header_data (struct lsqpack_dec *dec,
             break;
         case DATA_STATE_READ_VAL_PLAIN:
             size = MIN((unsigned) (end - buf), DATA.left);
-            assert(size);
+            if (size == 0)
+                RETURN_ERROR();
             dst = get_dst(dec, read_ctx, &dst_size);
-            assert(size <= dst_size);
+            if (size > dst_size)
+                RETURN_ERROR();
             memcpy(dst, buf, size);
             if (0 != header_out_write_value(dec, read_ctx,
                                                 size, DATA.left == size))
@@ -3723,7 +3726,8 @@ parse_header_data (struct lsqpack_dec *dec,
             break;
         case DATA_STATE_READ_NAME_HUFFMAN:
             size = MIN((unsigned) (end - buf), DATA.left);
-            assert(size);
+            if (size == 0)
+                RETURN_ERROR();
             dst = get_dst(dec, read_ctx, &dst_size);
             hdr = lsqpack_huff_decode(buf, size, dst, dst_size,
                     &DATA.dec_huff_state, DATA.left == size);
@@ -3756,9 +3760,11 @@ parse_header_data (struct lsqpack_dec *dec,
             break;
         case DATA_STATE_READ_NAME_PLAIN:
             size = MIN((unsigned) (end - buf), DATA.left);
-            assert(size);
+            if (size == 0)
+                RETURN_ERROR();
             dst = get_dst(dec, read_ctx, &dst_size);
-            assert(size <= dst_size);
+            if (size > dst_size)
+                RETURN_ERROR();
             memcpy(dst, buf, size);
             if (0 != header_out_write_name(dec, read_ctx,
                                                 size, DATA.left == size))

diff --git a/lsqpack.h b/lsqpack.h
@@ -5,7 +5,7 @@
 /*
 MIT License
 
-Copyright (c) 2018 - 2020 LiteSpeed Technologies Inc
+Copyright (c) 2018 - 2021 LiteSpeed Technologies Inc
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -44,7 +44,7 @@ typedef SSIZE_T ssize_t;
 
 #define LSQPACK_MAJOR_VERSION 2
 #define LSQPACK_MINOR_VERSION 2
-#define LSQPACK_PATCH_VERSION 1
+#define LSQPACK_PATCH_VERSION 2
 
 /** Let's start with four billion for now */
 typedef unsigned lsqpack_abs_id_t;