Philip Martin <philip.mar...@wandisco.com> writes:
> Index: buckets/response_buckets.c
> ===================================================================
> --- buckets/response_buckets.c (revision 2445)
> +++ buckets/response_buckets.c (working copy)
> @@ -129,7 +129,10 @@ static apr_status_t parse_status_line(response_con
> char *reason; /* ### stupid APR interface makes this non-const */
>
> /* ctx->linebuf.line should be of form: HTTP/1.1 200 OK */
> - res = apr_date_checkmask(ctx->linebuf.line, "HTTP/#.# ###*");
> + if (ctx->linebuf.used < 13) {
> + return SERF_ERROR_BAD_HTTP_RESPONSE;
> + }
> + res = apr_date_checkmask(ctx->linebuf.line, "HTTP/#.# ### *");
> if (!res) {
> /* Not an HTTP response? Well, at least we won't understand it. */
> return SERF_ERROR_BAD_HTTP_RESPONSE;
That's not enough, we also need to stop the apr_isspace loop from
running beyond the used bytes:
Index: buckets/response_buckets.c
===================================================================
--- buckets/response_buckets.c (revision 2445)
+++ buckets/response_buckets.c (working copy)
@@ -129,7 +129,10 @@ static apr_status_t parse_status_line(response_con
char *reason; /* ### stupid APR interface makes this non-const */
/* ctx->linebuf.line should be of form: HTTP/1.1 200 OK */
- res = apr_date_checkmask(ctx->linebuf.line, "HTTP/#.# ###*");
+ if (ctx->linebuf.used < 13) {
+ return SERF_ERROR_BAD_HTTP_RESPONSE;
+ }
+ res = apr_date_checkmask(ctx->linebuf.line, "HTTP/#.# ### *");
if (!res) {
/* Not an HTTP response? Well, at least we won't understand it. */
return SERF_ERROR_BAD_HTTP_RESPONSE;
@@ -140,7 +143,8 @@ static apr_status_t parse_status_line(response_con
ctx->sl.code = apr_strtoi64(ctx->linebuf.line + 8, &reason, 10);
/* Skip leading spaces for the reason string. */
- if (apr_isspace(*reason)) {
+ if (apr_isspace(*reason)
+ && reason < ctx->linebuf.line + ctx->linebuf.used) {
reason++;
}
With that loop fix we could drop the requirement for a space after the
status code and change the length check to 12. It depends whether we
want the minimum status line to be
"HTTP/1.1 207 "
or
"HTTP/1.1 207"
--
Philip Martin | Subversion Committer
WANdisco // *Non-Stop Data*
