Description: Correctly handle bogusly large chunk sizes.
 This fixes a denial of service attack vector where bogusly large chunk
 sizes in requests could be used to force restarts of the Varnish
 server.
 .
 This is Varnish Security Vulnerability VSV00001
 .
 This fixes CVE-2017-12425.
Author: Martin Blix Grydeland <martin@varnish-software.com>
Origin: backport
Bug: https://varnish-cache.org/security/VSV00001
Bug-Ubuntu: https://pad.lv/1709153
Reviewed-By: Simon Quigley <tsimonq2@ubuntu.com>
Last-Update: 2017-08-08
--- a/bin/varnishd/cache_fetch.c
+++ b/bin/varnishd/cache_fetch.c
@@ -254,7 +254,7 @@ fetch_number(const char *nbr, int radix)
 		return (-1);
 
 	cl = (ssize_t)cll;
-	if((uintmax_t)cl != cll) /* Protect against bogusly large values */
+	if (cl < 0 || (uintmax_t)cl != cll) /* Protect against bogusly large values */
 		return (-1);
 	return (cl);
 }
--- /dev/null
+++ b/bin/varnishtest/tests/f00001.vtc
@@ -0,0 +1,40 @@
+varnishtest "Check that we handle bogusly large chunks correctly"
+
+# Check that the bug has been fixed
+
+server s1 {
+	rxreq
+	txresp
+} -start
+
+varnish v1 -vcl+backend {
+} -start
+
+client c1 {
+	send "POST / HTTP/1.1\r\n"
+	send "Transfer-Encoding: chunked\r\n\r\n"
+	send "FFFFFFFFFFFFFFED\r\n"
+	send "0\r\n\r\n"
+
+	rxresp
+	expect resp.status == 503
+} -run
+
+# Check that the published workaround does not cause harm
+
+varnish v1 -vcl+backend {
+	sub vcl_recv {
+		if (req.http.transfer-encoding ~ "(?i)chunked") {
+			return (fail);
+		}
+	}
+}
+
+client c1 {
+	send "POST / HTTP/1.1\r\n"
+	send "Transfer-Encoding: chunked\r\n\r\n"
+	send "FFFFFFFFFFFFFFED\r\n"
+
+	rxresp
+	expect resp.status == 503
+} -run
