From 245946bb789c8fc0e4758c344f735a5d53827dce Mon Sep 17 00:00:00 2001
From: rofl0r <rofl0r@users.noreply.github.com>
Date: Thu, 12 Mar 2026 14:26:24 +0000
Subject: [PATCH] reqs: check negative length values when reading chunked data

this could lead to a DoS when a legitimate client reads from an
attacker-controlled web server.

closes #597

CVE: CVE-2026-3945
Upstream-Status: Backport [https://github.com/tinyproxy/tinyproxy/commit/969852ccdb1d19d7ed302f0e1d324661be641e0a]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
 src/reqs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/reqs.c b/src/reqs.c
index a562c68..94ce767 100644
--- a/src/reqs.c
+++ b/src/reqs.c
@@ -613,6 +613,7 @@ static int pull_client_data_chunked (struct conn_s *connptr) {
                 }
 
                 chunklen = strtol (buffer, (char**)0, 16);
+                if (chunklen < 0) goto ERROR_EXIT;
 
                 if (pull_client_data (connptr, chunklen+2, 0) < 0)
                         goto ERROR_EXIT;
