deal with negative Content-Length: headers by ignoring the info

1 files changed, 16 insertions, 7 deletions

diff --git a/lib/transfer.c b/lib/transfer.c
index b962b7e59..c6e4b04cb 100644
--- a/lib/transfer.c
+++ b/lib/transfer.c
@@ -668,12 +668,21 @@ CURLcode Curl_readwrite(struct connectdata *conn,
             if ((k->httpcode != 416) &&
                 checkprefix("Content-Length:", k->p)) {
               contentlength = curlx_strtoofft(k->p+15, NULL, 10);
-              if (data->set.max_filesize && contentlength >
-                  data->set.max_filesize) {
+              if (data->set.max_filesize &&
+                  contentlength > data->set.max_filesize) {
                 failf(data, "Maximum file size exceeded");
                 return CURLE_FILESIZE_EXCEEDED;
               }
-              conn->size = contentlength;
+              if(contentlength >= 0)
+                conn->size = contentlength;
+              else {
+                /* Negative Content-Length is really odd, and we know it
+                   happens for example when older Apache servers send large
+                   files */
+                conn->bits.close = TRUE;
+                infof(data, "Negative content-length: %" FORMAT_OFF_T
+                      ", closing after transfer\n", contentlength);
+              }
             }
             /* check for Content-Type: header lines to get the mime-type */
             else if (checkprefix("Content-Type:", k->p)) {
@@ -1278,15 +1287,15 @@ CURLcode Curl_readwrite(struct connectdata *conn,
   if(Curl_pgrsUpdate(conn))
     result = CURLE_ABORTED_BY_CALLBACK;
   else
-    result = Curl_speedcheck (data, k->now);
+    result = Curl_speedcheck(data, k->now);
   if (result)
     return result;
 
   if (data->set.timeout &&
       ((Curl_tvdiff(k->now, k->start)/1000) >= data->set.timeout)) {
-    failf (data, "Operation timed out with %" FORMAT_OFF_T
-           " out of %" FORMAT_OFF_T " bytes received",
-           k->bytecount, conn->size);
+    failf(data, "Operation timed out with %" FORMAT_OFF_T
+          " out of %" FORMAT_OFF_T " bytes received",
+          k->bytecount, conn->size);
     return CURLE_OPERATION_TIMEOUTED;
   }