RomkaZVO/xash3d-fwgs
1
0
Fork 0
mirror of https://github.com/FWGS/xash3d-fwgs.git synced 2026-08-05 03:24:56 +08:00
Code Issues Packages Projects Releases Wiki Activity

engine: limit decompressed buffer alloc size to 64MiB

Browse Source
This commit is contained in:
Alibek Omarov
2026-05-17 10:55:38 +05:00
parent be35b3503e
commit 9d050e7ed3
2 changed files with 30 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
engine/common/http/net_http_xash.c
View File

@@ -30,6 +30,7 @@ HTTP downloader
*/
#define MAX_HTTP_BUFFER_SIZE (BIT( 16 ))
#define MAX_HTTP_DECOMPRESSED_SIZE ( 64 * 1024 * 1024 )
typedef struct httpserver_s
{
@@ -471,6 +472,13 @@ static int HTTP_FileDecompress( httpfile_t *file )
decompressed_len = data[0] | data[1] << 8 | data[2] << 16 | data[3] << 24;
}
if( decompressed_len == 0 || decompressed_len > MAX_HTTP_DECOMPRESSED_SIZE )
{
Con_Printf( S_ERROR "%s: refusing to decompress %s, claimed size out of range (%zu)\n", __func__, file->path, decompressed_len );
HTTP_FreeFile( file, true );
return 0;
}
data_in = Mem_Malloc( host.mempool, compressed_len + 1 );
data_out = Mem_Malloc( host.mempool, decompressed_len + 1 );
@@ -500,7 +508,7 @@ static int HTTP_FileDecompress( httpfile_t *file )
if( zlib_result == Z_OK || zlib_result == Z_STREAM_END )
{
FS_AllowDirectPaths( true );
g_fsapi.WriteFile( name, data_out, decompressed_len );
g_fsapi.WriteFile( name, data_out, decompress_stream.total_out );
FS_AllowDirectPaths( false );
HTTP_FreeFile( file, false );
}