wt/mongoose
1
0 Fork 0
mirror of https://github.com/cesanta/mongoose.git synced 2026-10-20 11:19:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Better checks in skip_chunk()

Browse Source
This commit is contained in:
Sergey Lyubka committed 2023-12-29 11:59:02 +00:00
1 parent 3965aecfd4
commit 744df7b244
2 files changed
+8 -6
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

mongoose.c
+4 -3
View File
@@ -2818,10 +2818,11 @@ static int skip_chunk(const char *buf, int len, int *pl, int *dl) {
int i = 0, n = 0;
if (len < 3) return 0;
while (i < len && is_hex_digit(buf[i])) i++;
if (i > (int) sizeof(int) * 2) return -1; // Chunk length is too big
if (len < i + 1 || buf[i] != '\r' || buf[i + 1] != '\n') return -1; // Error
n = (int) mg_unhexn(buf, (size_t) i); // Decode hex length
n = (int) mg_unhexn(buf, (size_t) i); // Decode chunk length
if (n < 0) return -1; // Error
if (len < i + n + 4) return 0; // Chunk not yet fully buffered
if (n > len - i - 4) return 0; // Chunk not yet fully buffered
if (buf[i + n + 2] != '\r' || buf[i + n + 3] != '\n') return -1; // Error
*pl = i + 2, *dl = n;
return i + 2 + n + 2;
@@ -2851,7 +2852,7 @@ static void http_cb(struct mg_connection *c, int ev, void *evd, void *fnd) {
if (mg_vcasecmp(te, "chunked") == 0) {
is_chunked = true;
} else {
mg_error(c, "Invalid Transfer-Encoding"); // See #2460
mg_error(c, "Invalid Transfer-Encoding"); // See #2460
return;
}
}
src/http.c
+4 -3
View File
@@ -963,10 +963,11 @@ static int skip_chunk(const char *buf, int len, int *pl, int *dl) {
int i = 0, n = 0;
if (len < 3) return 0;
while (i < len && is_hex_digit(buf[i])) i++;
if (i > (int) sizeof(int) * 2) return -1; // Chunk length is too big
if (len < i + 1 || buf[i] != '\r' || buf[i + 1] != '\n') return -1; // Error
n = (int) mg_unhexn(buf, (size_t) i); // Decode hex length
n = (int) mg_unhexn(buf, (size_t) i); // Decode chunk length
if (n < 0) return -1; // Error
if (len < i + n + 4) return 0; // Chunk not yet fully buffered
if (n > len - i - 4) return 0; // Chunk not yet fully buffered
if (buf[i + n + 2] != '\r' || buf[i + n + 3] != '\n') return -1; // Error
*pl = i + 2, *dl = n;
return i + 2 + n + 2;
@@ -996,7 +997,7 @@ static void http_cb(struct mg_connection *c, int ev, void *evd, void *fnd) {
if (mg_vcasecmp(te, "chunked") == 0) {
is_chunked = true;
} else {
mg_error(c, "Invalid Transfer-Encoding"); // See #2460
mg_error(c, "Invalid Transfer-Encoding"); // See #2460
return;
}
}