gitproxy/RTLPlayground
1
0
Fork 0
mirror of https://github.com/logicog/RTLPlayground.git synced 2026-09-02 15:02:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

httpd: keep scan_header() on the terminator of a truncated header

Browse Source 
The scan stepped over the NUL that ends the received data before breaking,
so on a request whose headers were cut short it returned a pointer one past
the data. handle_post() then tested that byte for the end of the header,
reading whatever an earlier packet had left there instead of the NUL the
appcall wrote, and could go on to run an endpoint against the stale bytes.
Break before advancing so the returned pointer sits on the NUL and the
caller's check sees it.
This commit is contained in:
bloqaudio
2026-09-01 14:52:09 -05:00
parent d6bf46595a
commit cbcf67a693
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
httpd/httpd.c
+2 -1
View File
@@ -277,8 +277,9 @@ __xdata uint8_t *scan_header(__xdata uint8_t * __xdata p)
while (!strstart(p, "\r\n\r\n")) {
dbg_char(*p);
if (!*p++)
if (!*p)
break;
p++;
if ((v = header_value(p, "\ncontent-type:")))
content_type = v;
else if ((v = header_value(p, "\ncookie:"))) {