parser: fix panic on invalid input

Found with cargo-fuzz
memfd
Manos Pitsidianakis 4 years ago
parent 5d07a5147b
commit f2ecb81612
No known key found for this signature in database
GPG Key ID: 73627C2F690DF710

@ -190,6 +190,9 @@ fn header_with_val(input: &[u8]) -> IResult<&[u8], (&[u8], &[u8])> {
return IResult::Error(error_code!(ErrorKind::Custom(43))); return IResult::Error(error_code!(ErrorKind::Custom(43)));
} }
} }
if ptr >= input.len() {
return IResult::Error(error_code!(ErrorKind::Custom(43)));
}
while input[ptr] == b' ' || input[ptr] == b'\t' { while input[ptr] == b' ' || input[ptr] == b'\t' {
ptr += 1; ptr += 1;
if ptr >= input.len() { if ptr >= input.len() {
@ -227,7 +230,7 @@ fn header_without_val(input: &[u8]) -> IResult<&[u8], (&[u8], &[u8])> {
return IResult::Error(error_code!(ErrorKind::Custom(43))); return IResult::Error(error_code!(ErrorKind::Custom(43)));
} }
} }
if name.is_empty() { if name.is_empty() || input.len() <= ptr {
return IResult::Error(error_code!(ErrorKind::Custom(43))); return IResult::Error(error_code!(ErrorKind::Custom(43)));
} }
if input[ptr] == b':' { if input[ptr] == b':' {
@ -937,6 +940,9 @@ pub fn phrase(input: &[u8], multiline: /* preserve newlines */ bool) -> IResult<
.unwrap_or_else(|| ascii_s + input[ascii_s..].len()); .unwrap_or_else(|| ascii_s + input[ascii_s..].len());
ptr = ascii_e; ptr = ascii_e;
} }
if ascii_s >= ascii_e {
return IResult::Error(error_code!(ErrorKind::Custom(43)));
}
acc.extend( acc.extend(
ascii_token(&input[ascii_s..ascii_e]) ascii_token(&input[ascii_s..ascii_e])

Loading…
Cancel
Save