diff options
| -rw-r--r-- | src/mail/ngx_mail_parse.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/mail/ngx_mail_parse.c b/src/mail/ngx_mail_parse.c index a694bf6b6..227b63abb 100644 --- a/src/mail/ngx_mail_parse.c +++ b/src/mail/ngx_mail_parse.c @@ -539,6 +539,9 @@ ngx_mail_imap_parse_command(ngx_mail_session_t *s) break; case sw_literal: + if (s->literal_len > NGX_MAX_SIZE_T_VALUE / 10) { + goto invalid; + } if (ch >= '0' && ch <= '9') { s->literal_len = s->literal_len * 10 + (ch - '0'); break; |