From d4afa46285f6495605ec14366406129893d05fda Mon Sep 17 00:00:00 2001 From: Dean Chen <862469039@qq.com> Date: Sun, 8 Nov 2026 12:27:28 +0500 Subject: [PATCH 1/3] http_server: reject negative max_decoded_body_size flb_utils_size_to_bytes() returns a signed value, but the config map stores size options in a size_t. A negative value such as -5M wraps around to a huge limit, and only the -1 parse error (SIZE_MAX) was rejected, so most negative values silently removed the decoded body limit. Treat any value that came from a negative size as invalid so startup fails the same way it does for unparseable values. Signed-off-by: Dean Chen <862469039@qq.com> --- src/http_server/flb_http_server.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/http_server/flb_http_server.c b/src/http_server/flb_http_server.c index f13b8e3c968..5764128ade7 100644 --- a/src/http_server/flb_http_server.c +++ b/src/http_server/flb_http_server.c @@ -1411,7 +1411,9 @@ int flb_http_server_init_with_options( if (options->max_decoded_body_size == 0) { options->max_decoded_body_size = HTTP_SERVER_DEFAULT_MAX_DECODED_BODY_SIZE; } - else if (options->max_decoded_body_size == SIZE_MAX) { + else if (options->max_decoded_body_size == SIZE_MAX || + (int64_t) options->max_decoded_body_size < 0) { + /* negative sizes from the config map wrap around in size_t */ flb_error("[http server] invalid http_server.max_decoded_body_size"); return -1; } From d338814c63108378c7cc1707bc8160cb592b4ea2 Mon Sep 17 00:00:00 2001 From: Dean Chen <862469039@qq.com> Date: Sun, 8 Nov 2026 12:27:28 +0500 Subject: [PATCH 2/3] tests: internal: http_server: cover negative max_decoded_body_size Add a test that a negative decoded body limit is rejected at init. Signed-off-by: Dean Chen <862469039@qq.com> --- tests/internal/http_server.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/tests/internal/http_server.c b/tests/internal/http_server.c index b15f478e71e..cf72b601ffd 100644 --- a/tests/internal/http_server.c +++ b/tests/internal/http_server.c @@ -10,6 +10,7 @@ #include #include #include +#include #include #include #include @@ -209,6 +210,17 @@ void test_http_server_rejects_invalid_decoded_body_limit() TEST_CHECK(flb_http_server_init_with_options(&server, &options) == -1); } +void test_http_server_rejects_negative_decoded_body_limit() +{ + struct flb_http_server server; + struct flb_http_server_options options; + + flb_http_server_options_init(&options); + options.max_decoded_body_size = (size_t) flb_utils_size_to_bytes("-5M"); + + TEST_CHECK(flb_http_server_init_with_options(&server, &options) == -1); +} + void test_http_server_options_multi_worker_magic() { struct flb_config *config; @@ -1328,6 +1340,8 @@ TEST_LIST = { { "http_request_compression_roundtrip", test_http_request_compression_roundtrip }, { "http_server_rejects_invalid_decoded_body_limit", test_http_server_rejects_invalid_decoded_body_limit }, + { "http_server_rejects_negative_decoded_body_limit", + test_http_server_rejects_negative_decoded_body_limit }, { "http_body_inflation_limit", test_http_body_inflation_limit }, { "http_body_inflation_budget", test_http_body_inflation_budget }, { "http1_rejects_invalid_partial_request_line", test_http1_rejects_invalid_partial_request_line }, From 79df6949a374d0a046796903d6c67ffa9f5723a0 Mon Sep 17 00:00:00 2001 From: Dean Chen <862469039@qq.com> Date: Sun, 8 Nov 2026 15:58:36 +0500 Subject: [PATCH 3/3] http_server: reject wrapped negative sizes on 32-bit Casting size_t to int64_t only looks negative when size_t is 64-bit. On 32-bit the value zero-extends, so -5M still passed init and the Windows unit test failed. Compare against the sign bit instead. Signed-off-by: Dean Chen <862469039@qq.com> --- src/http_server/flb_http_server.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/http_server/flb_http_server.c b/src/http_server/flb_http_server.c index 5764128ade7..217f159b720 100644 --- a/src/http_server/flb_http_server.c +++ b/src/http_server/flb_http_server.c @@ -1411,9 +1411,10 @@ int flb_http_server_init_with_options( if (options->max_decoded_body_size == 0) { options->max_decoded_body_size = HTTP_SERVER_DEFAULT_MAX_DECODED_BODY_SIZE; } - else if (options->max_decoded_body_size == SIZE_MAX || - (int64_t) options->max_decoded_body_size < 0) { - /* negative sizes from the config map wrap around in size_t */ + else if (options->max_decoded_body_size > (SIZE_MAX >> 1)) { + /* negative sizes wrap into the high half of size_t. A cast to + * int64_t only looks negative when size_t is 64-bit; on 32-bit + * it zero-extends, so compare against the sign bit instead. */ flb_error("[http server] invalid http_server.max_decoded_body_size"); return -1; }