From cb0ae0b794bdd61a7834fd84c62e24bcf1b910f5 Mon Sep 17 00:00:00 2001
From: Nathaniel Wesley Filardo <nwfilardo@gmail.com>
Date: Fri, 1 Mar 2019 12:07:35 +0000
Subject: [PATCH] Add length limit for handbook HTML

---
 .../ctfwstimer/CheckedAsyncDownloader.java        | 15 +++++++++++++--
 .../ctfwstimer/HandbookDownloader.java            |  4 +++-
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/mobile/src/main/java/com/acmetensortoys/ctfwstimer/CheckedAsyncDownloader.java b/mobile/src/main/java/com/acmetensortoys/ctfwstimer/CheckedAsyncDownloader.java
index 1b85a3c..71907b5 100644
--- a/mobile/src/main/java/com/acmetensortoys/ctfwstimer/CheckedAsyncDownloader.java
+++ b/mobile/src/main/java/com/acmetensortoys/ctfwstimer/CheckedAsyncDownloader.java
@@ -25,17 +25,20 @@ public class CheckedAsyncDownloader extends AsyncTask<CheckedAsyncDownloader.DL,
     public static final long ERR_HOSTUNREACH = -4; /* Could not establish connection */
     public static final long ERR_XFER        = -5; /* Error during transfer */
     public static final long ERR_CHECKSUM    = -6; /* Checksum did not match after xfer */
+    public static final long ERR_TOO_LONG    = -7; /* File longer than maximum permitted */
 
     public static class DL {
         final URL url;
         final byte[] sha256;
         final File dest;
+        final long lengthLimit; /* In bytes, or 0 for no limit */
         long result;
 
-        public DL(URL url, byte[] sha256, File dest) {
+        public DL(URL url, byte[] sha256, long lim, File dest) {
             this.url = url;
             this.sha256 = sha256;
             this.dest = dest;
+            this.lengthLimit = lim;
             this.result = ERR_UNTRIED;
         }
     }
@@ -50,7 +53,7 @@ public class CheckedAsyncDownloader extends AsyncTask<CheckedAsyncDownloader.DL,
             return null;
         }
 
-        for (DL dl : dls) {
+        dlfor: for (DL dl : dls) {
             try {
                 DigestInputStream is = new DigestInputStream(
                         new BufferedInputStream(new FileInputStream(dl.dest)),
@@ -116,6 +119,14 @@ public class CheckedAsyncDownloader extends AsyncTask<CheckedAsyncDownloader.DL,
                 while ((count = is.read(data)) != -1) {
                     xfer += count;
                     os.write(data, 0, count);
+
+                    if (dl.lengthLimit > 0 && xfer > dl.lengthLimit) {
+                        is.close();
+                        os.close();
+                        dl.result = ERR_TOO_LONG;
+                        oft.delete();
+                        continue dlfor;
+                    }
                 }
 
                 is.close();
diff --git a/mobile/src/main/java/com/acmetensortoys/ctfwstimer/HandbookDownloader.java b/mobile/src/main/java/com/acmetensortoys/ctfwstimer/HandbookDownloader.java
index 990de78..bb2260f 100644
--- a/mobile/src/main/java/com/acmetensortoys/ctfwstimer/HandbookDownloader.java
+++ b/mobile/src/main/java/com/acmetensortoys/ctfwstimer/HandbookDownloader.java
@@ -20,6 +20,8 @@ public class HandbookDownloader implements IMqttMessageListener {
 
     private static String TAG = "HandbookDownloader";
 
+    private static final long HAND_MAX_LEN = 1024*1024; /* 1 MiB */
+
     private final Context mCtx;
     private final Runnable mDLFiniCB;
     private IMqttAsyncClient mMqc;
@@ -159,7 +161,7 @@ public class HandbookDownloader implements IMqttMessageListener {
             }
 
             this.downloader = new Task(mMqc);
-            this.download = new CheckedAsyncDownloader.DL(new URL(url), checksum,
+            this.download = new CheckedAsyncDownloader.DL(new URL(url), checksum, HAND_MAX_LEN,
                     new File(mCtx.getFilesDir(), HandbookActivity.HAND_FILE_NAME));
             this.downloader.execute(this.download);
         }
-- 
2.50.1