Skip to content
This repository has been archived by the owner on Jun 30, 2021. It is now read-only.

Serious issue in parser.c introduced in 3294cf4 #133

Open
derekmauro opened this issue Apr 2, 2019 · 0 comments
Open

Serious issue in parser.c introduced in 3294cf4 #133

derekmauro opened this issue Apr 2, 2019 · 0 comments

Comments

@derekmauro
Copy link

Commit 3294cf4 commented out this line for no clear reason.
https://github.com/criticalstack/libevhtp/blob/3294cf469fa2700b349f7621e6a6823d106825de/parser.c#L571-L572
Note that this line does not memset the buffer. It memsets the structure up until the buffer.

The result is that when htparser_run() is run, it should be pretty easy to see that buf_idx is used uninitialized here (when you expand the macro):
https://github.com/criticalstack/libevhtp/blob/3294cf469fa2700b349f7621e6a6823d106825de/parser.c#L786

I suspect this is the actual cause of several recently reported issues. It also seems that the htparse_error_too_big is not handled properly, because if I send enough requests, the server becomes unresponsive, but I didn't try to diagnose exactly why.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant