From 3b0ded4ae8110b6291d030af927ecd08197e668f Mon Sep 17 00:00:00 2001
From: Gyorgy Sarvari <skandigraun@gmail.com>
Date: Thu, 6 Feb 2025 21:12:37 -0800
Subject: [PATCH] Fix Github issue 70 A) Integer Underflow in
 raptor_uri_normalize_path()

From: Dave Beckett <dave@dajobe.org>

(raptor_uri_normalize_path): Return empty buffer if path gets to 0
length

CVE: CVE-2024-57822
Upstream-Status: Backport [github.com/dajobe/raptor/commit/da7a79976bd0314c23cce55d22495e7d29301c44]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
 src/raptor_rfc2396.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/raptor_rfc2396.c b/src/raptor_rfc2396.c
index 89183d9..2f0195f 100644
--- a/src/raptor_rfc2396.c
+++ b/src/raptor_rfc2396.c
@@ -351,6 +351,10 @@ raptor_uri_normalize_path(unsigned char* path_buffer, size_t path_len)
           *dest++ = *s++;
         *dest = '\0';
         path_len -= len;
+        if(path_len <= 0) {
+          *path_buffer = '\0';
+          return 0;
+        }
 
         if(p && p < prev) {
           /* We know the previous prev path component and we didn't do
@@ -390,6 +394,10 @@ raptor_uri_normalize_path(unsigned char* path_buffer, size_t path_len)
     /* Remove <component>/.. at the end of the path */
     *prev = '\0';
     path_len -= (s-prev);
+    if(path_len <= 0) {
+      *path_buffer = '\0';
+      return 0;
+    }
   }
 
 
