Changeset 1869

Timestamp:

06/15/2007 02:08:32 PM (16 months ago)

Author:

jan

Message:

fixed remote crash on duplicate header keys with line-wrapping (fixes #1230)

Location:

branches/lighttpd-1.4.x

Files:

• src/request.c (modified) (5 diffs)
• tests/core-request.t (modified) (2 diffs)

branches/lighttpd-1.4.x/src/request.c

@@ -284 +284 @@
 
         int done = 0;
-
-        data_string *ds = NULL;
 
         /*
@@ -716 +714 @@
                         case '\r':
                                 if (con->parse_request->ptr[i+1] == '\n') {
+                                        data_string *ds = NULL;
+
                                         /* End of Headerline */
                                         con->parse_request->ptr[i] = '\0';
@@ -721 +721 @@
 
                                         if (in_folding) {
-                                                if (!ds) {
+                                                buffer *key_b;
+                                                /**
+                                                 * we use a evil hack to handle the line-folding
+                                                 * 
+                                                 * As array_insert_unique() deletes 'ds' in the case of a duplicate
+                                                 * ds points somewhere and we get a evil crash. As a solution we keep the old
+                                                 * "key" and get the current value from the hash and append us
+                                                 *
+                                                 * */
+
+                                                if (!key || !key_len) {
                                                         /* 400 */
 
@@ -738 +748 @@
                                                         return 0;
                                                 }
-                                                buffer_append_string(ds->value, value);
+
+                                                key_b = buffer_init();
+                                                buffer_copy_string_len(key_b, key, key_len);
+
+                                                if (NULL != (ds = (data_string *)array_get_element(con->request.headers, key_b->ptr))) {
+                                                        buffer_append_string(ds->value, value);
+                                                }
+
+                                                buffer_free(key_b);
                                         } else {
                                                 int s_len;
@@ -970 +988 @@
                                         is_key = 1;
                                         value = 0;
-                                        key_len = 0;
+#if 0
+                                        /**
+                                         * for Bug 1230 keep the key_len a live
+                                         */
+                                        key_len = 0; 
+#endif
                                         in_folding = 0;
                                 } else {

branches/lighttpd-1.4.x/tests/core-request.t

@@ -9 +9 @@
 use strict;
 use IO::Socket;
-use Test::More tests => 33;
+use Test::More tests => 36;
 use LightyTest;
 
@@ -274 +274 @@
 ok($tf->handle_http($t) == 0, 'uppercase filenames');
 
+$t->{REQUEST}  = ( <<EOF
+GET / HTTP/1.0
+Location: foo
+Location: foobar
+  baz
+EOF
+ );
+$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200 } ];
+ok($tf->handle_http($t) == 0, '#1209 - duplicate headers with line-wrapping');
+
+$t->{REQUEST}  = ( <<EOF
+GET / HTTP/1.0
+Location: 
+Location: foobar
+  baz
+EOF
+ );
+$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200 } ];
+ok($tf->handle_http($t) == 0, '#1209 - duplicate headers with line-wrapping - test 2');
+
+$t->{REQUEST}  = ( <<EOF
+GET / HTTP/1.0
+A: 
+Location: foobar
+  baz
+EOF
+ );
+$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200 } ];
+ok($tf->handle_http($t) == 0, '#1209 - duplicate headers with line-wrapping - test 3');
+
+
+
 
 ok($tf->stop_proc == 0, "Stopping lighttpd");