From 22fdd3935bb0ed4aaf62c689dc0df94e74955a51 Mon Sep 17 00:00:00 2001
From: Adam Jensen <acjensen@gmail.com>
Date: Sun, 3 Jun 2018 12:16:51 -0400
Subject: [PATCH] Return upload length error if it's too small or too large

---
 unrouted_handler.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/unrouted_handler.go b/unrouted_handler.go
index e8a52e2..2b9411a 100644
--- a/unrouted_handler.go
+++ b/unrouted_handler.go
@@ -461,8 +461,8 @@ func (handler *UnroutedHandler) PatchFile(w http.ResponseWriter, r *http.Request
 
 	if handler.composer.UsesLengthDeferrer && info.SizeIsDeferred && r.Header.Get("Upload-Length") != "" {
 		uploadLength, err := strconv.ParseInt(r.Header.Get("Upload-Length"), 10, 64)
-		if err != nil || uploadLength < 0 {
-			handler.sendError(w, r, ErrInvalidOffset)
+		if err != nil || uploadLength < 0 || uploadLength < info.Offset || uploadLength > handler.config.MaxSize {
+			handler.sendError(w, r, ErrInvalidUploadLength)
 			return
 		}