search

xach / snarf

URL fetcher
GNU General Public License v2.0
2 stars 1 forks source link

atoi() is not safe against large files #1

Open glasserc opened 11 years ago

glasserc commented 11 years ago

Hi!

I'm trying to download a file which has a content-length of 2608578106 bytes (2.4 GB). When I try using snarf, I get

warning: you already have all of `indiegamethemovie-1080p-1356475247.zip', skipping

even though the local file, indiegamethemovie-1080p-1356475247.zip is empty. I believe this to be due to line 427 on http.c, which says 

rsrc->outfile_size = (off_t )atoi(len_string);

I tried this line in a standalone program, as follows:

printf("%ld\n", (off_t)atoi("2608578106"));

This prints out -1686389190. I believe this is causing the condition on line 157 of file util.c to become true because the size of the file is negative.

It seems like you ought to be able to trivially fix this using atol or strtol, but in my brief testing it seemed like these returned ints and not longs. Maybe I have the compiler flags wrong or something.

Thanks for your time!

xach commented 11 years ago

Thanks for the report! I'll try to look into it soon.