rest: reject negative sizes in HTTP response headers - fixes #10041

lib/rest/headers.go

@@ -165,7 +165,7 @@ func ParseSizeFromHeaders(headers http.Header) (size int64) {
 	var contentLength = headers.Get("Content-Length")
 	if len(contentLength) != 0 {
 		var err error
-		if size, err = strconv.ParseInt(contentLength, 10, 64); err != nil {
+		if size, err = strconv.ParseInt(contentLength, 10, 64); err != nil || size < 0 {
 			return -1
 		}
 	}
@@ -183,7 +183,7 @@ func ParseSizeFromHeaders(headers http.Header) (size int64) {
 		return -1
 	}
 	ret, err := strconv.ParseInt(contentRange[slash+1:], 10, 64)
-	if err != nil {
+	if err != nil || ret < 0 {
 		return -1
 	}
 	return ret

lib/rest/headers_test.go

@@ -16,6 +16,12 @@ func TestParseSizeFromHeaders(t *testing.T) {
 		"", "", -1,
 	}, {
 		"42", "", 42,
+	}, {
+		"0", "", 0,
+	}, {
+		"-5", "", -1,
+	}, {
+		"-5", "bytes 0-1/42", -1,
 	}, {
 		"42", "invalid", -1,
 	}, {
@@ -26,6 +32,12 @@ func TestParseSizeFromHeaders(t *testing.T) {
 		"12", "otherUnit 22-33/42", -1,
 	}, {
 		"12", "bytes 22-33/*", -1,
+	}, {
+		"", "bytes 0-1/-5", -1,
+	}, {
+		"2", "bytes 0-1/-5", -1,
+	}, {
+		"", "bytes */0", 0,
 	}, {
 		"0", "bytes */42", 42,
 	}}