Fix buffer overflow downloading large pac file

This fixes CVE CVE-2012-4504
libproxy · Oct 10, 2012 · c440553 · c440553
1 parent ffc977c
commit c440553
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/libproxy/url.cpp b/libproxy/url.cpp
@@ -474,9 +474,10 @@ char* url::get_pac() {
 				// Add this chunk to our content length,
 				// ensuring that we aren't over our max size
 				content_length += chunk_length;
-				if (content_length >= PAC_MAX_SIZE) break;
 			}
 
+			if (content_length >= PAC_MAX_SIZE) break;
+
 			while (recvd != content_length) {
 				int r = recv(sock, buffer + recvd, content_length - recvd, 0);
 				if (r < 0) break;