1 file changed, 11 insertions, 1 deletion
diff --git a/source/cgit.c b/source/cgit.c
index d80aebd..156d2a7 100644
--- a/source/cgit.c
+++ b/source/cgit.c
@@ -344,7 +344,17 @@ static void querystring_cb(const char *name, const char *value)
 		ctx.qry.oid2 = xstrdup(value);
 		ctx.qry.has_oid = 1;
 	} else if (!strcmp(name, "ofs")) {
-		ctx.qry.ofs = atoi(value);
+		/* Bound the upper end so a crafted value cannot force a walk
+		 * over the whole history (and strtol avoids the atoi overflow).
+		 * Only clamp the upper end: ofs is overloaded, the stats page
+		 * submits -1 for "all authors", and the log skip loop already
+		 * floors negatives at zero. */
+		long ofs = strtol(value, NULL, 10);
+		if (ofs > 100000)
+			ofs = 100000;
+		else if (ofs < -1)
+			ofs = -1;
+		ctx.qry.ofs = ofs;
 	} else if (!strcmp(name, "path")) {
 		ctx.qry.path = trim_end(value, '/');
 	} else if (!strcmp(name, "name")) {