[glib/wip/2-58-cve-2021-27219: 2/3] gwinhttpfile: Avoid arithmetic overflow when calculating a size

[Simon McVittie <smcv src gnome org>]

commit 5c26b6a7f656feeb09ecccb573e6ac6b9e9dbfd8
Author: Philip Withnall <pwithnall endlessos org>
Date:   Thu Feb 4 16:12:24 2021 +0000

    gwinhttpfile: Avoid arithmetic overflow when calculating a size
    
    The members of `URL_COMPONENTS` (`winhttp_file->url`) are `DWORD`s, i.e.
    32-bit unsigned integers. Adding to and multiplying them may cause them
    to overflow the unsigned integer bounds, even if the result is passed to
    `g_memdup2()` which accepts a `gsize`.
    
    Cast the `URL_COMPONENTS` members to `gsize` first to ensure that the
    arithmetic is done in terms of `gsize`s rather than unsigned integers.
    
    Spotted by Sebastian Dröge.
    
    Signed-off-by: Philip Withnall <pwithnall endlessos org>
    Helps: #2319
    (cherry picked from commit 0cbad673215ec8a049b7fe2ff44b0beed31b376e)

 gio/win32/gwinhttpfile.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
---
diff --git a/gio/win32/gwinhttpfile.c b/gio/win32/gwinhttpfile.c
index f424d21cc..e98031a98 100644
--- a/gio/win32/gwinhttpfile.c
+++ b/gio/win32/gwinhttpfile.c
@@ -394,10 +394,10 @@ g_winhttp_file_resolve_relative_path (GFile      *file,
   child = g_object_new (G_TYPE_WINHTTP_FILE, NULL);
   child->vfs = winhttp_file->vfs;
   child->url = winhttp_file->url;
-  child->url.lpszScheme = g_memdup2 (winhttp_file->url.lpszScheme, (winhttp_file->url.dwSchemeLength+1)*2);
-  child->url.lpszHostName = g_memdup2 (winhttp_file->url.lpszHostName, 
(winhttp_file->url.dwHostNameLength+1)*2);
-  child->url.lpszUserName = g_memdup2 (winhttp_file->url.lpszUserName, 
(winhttp_file->url.dwUserNameLength+1)*2);
-  child->url.lpszPassword = g_memdup2 (winhttp_file->url.lpszPassword, 
(winhttp_file->url.dwPasswordLength+1)*2);
+  child->url.lpszScheme = g_memdup2 (winhttp_file->url.lpszScheme, ((gsize) winhttp_file->url.dwSchemeLength 
+ 1) * 2);
+  child->url.lpszHostName = g_memdup2 (winhttp_file->url.lpszHostName, ((gsize) 
winhttp_file->url.dwHostNameLength + 1) * 2);
+  child->url.lpszUserName = g_memdup2 (winhttp_file->url.lpszUserName, ((gsize) 
winhttp_file->url.dwUserNameLength + 1) * 2);
+  child->url.lpszPassword = g_memdup2 (winhttp_file->url.lpszPassword, ((gsize) 
winhttp_file->url.dwPasswordLength + 1) * 2);
   child->url.lpszUrlPath = wnew_path;
   child->url.dwUrlPathLength = wcslen (wnew_path);
   child->url.lpszExtraInfo = NULL;