bf33699
diff -rup varnish-5.1.2.orig/bin/varnishd/http1/cache_http1_vfp.c varnish-5.1.2/bin/varnishd/http1/cache_http1_vfp.c
bf33699
--- varnish-5.1.2.orig/bin/varnishd/http1/cache_http1_vfp.c	2017-08-02 22:43:30.137116214 +0200
bf33699
+++ varnish-5.1.2/bin/varnishd/http1/cache_http1_vfp.c	2017-08-02 22:44:06.433218762 +0200
bf33699
@@ -152,7 +152,7 @@ v1f_pull_chunked(struct vfp_ctx *vc, str
bf33699
 		if (q == NULL || *q != '\0')
bf33699
 			return (VFP_Error(vc, "chunked header number syntax"));
bf33699
 		cl = (ssize_t)cll;
bf33699
-		if ((uintmax_t)cl != cll)
bf33699
+		if (cl < 0 || (uintmax_t)cl != cll)
bf33699
 			return (VFP_Error(vc, "bogusly large chunk size"));
bf33699
 
bf33699
 		vfe->priv2 = cl;