Curl_range: add check to ensure "from <= to"

diff --git a/lib/curl_range.c b/lib/curl_range.c
index e24215f4d67f3e50529767dbe19dc5d39581fb8d..849e12fd355990005639c67c6ad189ebac4f66b0 100644 (file)
--- a/lib/curl_range.c
+++ b/lib/curl_range.c
@@ -36,7 +36,6 @@
 CURLcode Curl_range(struct connectdata *conn)
 {
   curl_off_t from, to;
-  curl_off_t totalsize = -1;
   char *ptr;
   char *ptr2;
   struct Curl_easy *data = conn->data;
@@ -67,10 +66,16 @@ CURLcode Curl_range(struct connectdata *conn)
     }
     else {
       /* X-Y */
-      totalsize = to-from;
+      curl_off_t totalsize;
+
+      /* Ensure the range is sensible - to should follow from. */
+      if(from > to)
+        return CURLE_RANGE_ERROR;
+
+      totalsize = to - from;
       if(totalsize == CURL_OFF_T_MAX)
-        /* this is too big to increase, so bail out */
         return CURLE_RANGE_ERROR;
+
       data->req.maxdownload = totalsize + 1; /* include last byte */
       data->state.resume_from = from;
       DEBUGF(infof(data, "RANGE from %" CURL_FORMAT_CURL_OFF_T