Page MenuHomeFreeBSD
Files F177532013

D61267.1794646264.diff
No OneTemporary
Actions

Authored By
Unknown
Size
2 KB
Referenced Files
None
Subscribers
None

D61267.1794646264.diff
View Options

diff --git a/lib/libfetch/http.c b/lib/libfetch/http.c
--- a/lib/libfetch/http.c
+++ b/lib/libfetch/http.c
@@ -72,6 +72,7 @@
#include <netdb.h>
#include <stdarg.h>
#include <stdbool.h>
+#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
@@ -152,7 +153,9 @@
};
/*
- * Get next chunk header
+ * Get next chunk header. Returns 1 if a chunk of data follows, 0 at the
+ * terminating zero-size chunk and -1 if the header is malformed, which
+ * includes the connection closing where a chunk header was expected.
*/
static int
http_new_chunk(struct httpio *io)
@@ -165,6 +168,8 @@
for (p = io->conn->line;
*p != '\0' && !isspace((unsigned char)*p) && *p != ';';
p++) {
+ if (io->chunksize > SIZE_MAX >> 4)
+ return (-1);
io->chunksize <<= 4;
if (*p >= '0' && *p <= '9')
io->chunksize += *p - '0';
@@ -176,6 +181,10 @@
return (-1);
}
+ /* no size at all: an empty line or a bare chunk extension */
+ if (p == io->conn->line)
+ return (-1);
+
#ifndef NDEBUG
if (fetchDebug) {
io->total += io->chunksize;
@@ -188,7 +197,7 @@
}
#endif
- return (io->chunksize);
+ return (io->chunksize != 0);
}
/*
@@ -253,18 +262,24 @@
len = io->chunksize;
if (http_growbuf(io, len) == -1)
return (-1);
- if ((nbytes = fetch_bufread(io->conn, io->buf, len)) == -1) {
- io->error = errno;
+ if ((nbytes = fetch_bufread(io->conn, io->buf, len)) <= 0) {
+ /* a close inside a chunk is a truncated body, not EOF */
+ io->error = (nbytes == -1) ? errno : EPROTO;
return (-1);
}
io->bufpos = 0;
io->buflen = nbytes;
io->chunksize -= nbytes;
+ /* the chunk data must be followed by CRLF */
if (io->chunksize == 0) {
- if (fetch_bufread(io->conn, &ch, 1) != 1 || ch != '\r' ||
- fetch_bufread(io->conn, &ch, 1) != 1 || ch != '\n')
+ if ((nbytes = fetch_bufread(io->conn, &ch, 1)) != 1 ||
+ ch != '\r' ||
+ (nbytes = fetch_bufread(io->conn, &ch, 1)) != 1 ||
+ ch != '\n') {
+ io->error = (nbytes == -1) ? errno : EPROTO;
return (-1);
+ }
}
return (io->buflen);

File Metadata

Mime Type
text/plain
Expires
Sat, Nov 14, 8:51 AM (4 h, 31 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
41552977
Default Alt Text
D61267.1794646264.diff (2 KB)

Event Timeline