From 72ecb3f4e05b2fc0a5073d23fd178686818eb958 Mon Sep 17 00:00:00 2001 From: Aaron Patterson Date: Tue, 13 Feb 2024 13:34:34 -0800 Subject: [PATCH] Return an empty array when ranges are too large If the sum of the requested ranges is larger than the file itself, return an empty array. In other words, refuse to respond with any bytes. [CVE-2024-26141] --- lib/rack/utils.rb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lib/rack/utils.rb b/lib/rack/utils.rb index ca6182c..199312f 100644 --- a/lib/rack/utils.rb +++ b/lib/rack/utils.rb @@ -379,6 +379,9 @@ module Rack end ranges << (r0..r1) if r0 <= r1 end + + return [] if ranges.map(&:size).sum > size + ranges end -- 2.43.0