From 8f12872b8e50fe22be0a65ead260ebbedde905cd Mon Sep 17 00:00:00 2001
From: rofl0r <rofl0r@users.noreply.github.com>
Date: Sun, 29 Mar 2026 16:48:54 +0200
Subject: [PATCH] reqs: prevent potential int overflow when parsing chunked
 data (#603)

follow-up to 969852ccdb1d19d7ed302f0e1d324661be641e0a

closes #602

CVE: CVE-2026-3945
Upstream-Status: Backport [https://github.com/tinyproxy/tinyproxy/commit/bb7edc4778041b3bc8ad7fca448b67d98039cc7d]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
 src/reqs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/reqs.c b/src/reqs.c
index 94ce767..7aacfd3 100644
--- a/src/reqs.c
+++ b/src/reqs.c
@@ -613,7 +613,8 @@ static int pull_client_data_chunked (struct conn_s *connptr) {
                 }
 
                 chunklen = strtol (buffer, (char**)0, 16);
-                if (chunklen < 0) goto ERROR_EXIT;
+                /* prevent negative or huge values causing overflow */
+                if (chunklen < 0 || chunklen > 0x0fffffff) goto ERROR_EXIT;
 
                 if (pull_client_data (connptr, chunklen+2, 0) < 0)
                         goto ERROR_EXIT;
