[glib: 1/2] Adding a missing test on integer overflow within g_http_proxy_connect()

[Philip Withnall <pwithnall src gnome org>]

commit a5e3be4a0cd4f75192694e505e89172bb4357f59
Author: Emmanuel Fleury <emmanuel fleury gmail com>
Date:   Tue Feb 9 18:07:20 2021 +0000

    Adding a missing test on integer overflow within g_http_proxy_connect()
    
    Fixes #2315

 gio/ghttpproxy.c | 11 +++++++++++
 1 file changed, 11 insertions(+)
---
diff --git a/gio/ghttpproxy.c b/gio/ghttpproxy.c
index cd0bda4e6..505a8fecb 100644
--- a/gio/ghttpproxy.c
+++ b/gio/ghttpproxy.c
@@ -255,6 +255,17 @@ g_http_proxy_connect (GProxy         *proxy,
 
       if (bytes_read == buffer_length)
         {
+          /* HTTP specifications does not defines any upper limit for
+           * headers. But, the most usual size used seems to be 8KB.
+           * Yet, the biggest we found was Tomcat's HTTP headers whose
+           * size is 48K. So, for a reasonable error margin, let's accept
+           * a header with a twice as large size but no more: 96KB */
+          if (buffer_length > 98304)
+            {
+              g_set_error_literal (error, G_IO_ERROR, G_IO_ERROR_PROXY_FAILED,
+                                   _("HTTP proxy response too big"));
+              goto error;
+            }
           buffer_length = 2 * buffer_length;
           buffer = g_realloc (buffer, buffer_length);
         }