|
 |
93e6fe |
diff -up http-parser-2.7.1/http_parser.c.cve http-parser-2.7.1/http_parser.c
|
|
|
93e6fe |
--- http-parser-2.7.1/http_parser.c.cve 2019-03-23 09:08:12.831806096 +0100
|
|
|
93e6fe |
+++ http-parser-2.7.1/http_parser.c 2019-03-23 09:09:45.047875248 +0100
|
|
|
93e6fe |
@@ -1483,6 +1483,11 @@ reexecute:
|
|
|
93e6fe |
parser->header_state = h_content_length_num;
|
|
|
93e6fe |
break;
|
|
|
93e6fe |
|
|
|
93e6fe |
+ /* when obsolete line folding is encountered for content length
|
|
|
93e6fe |
+ * continue to the s_header_value state */
|
|
|
93e6fe |
+ case h_content_length_ws:
|
|
|
93e6fe |
+ break;
|
|
|
93e6fe |
+
|
|
|
93e6fe |
case h_connection:
|
|
|
93e6fe |
/* looking for 'Connection: keep-alive' */
|
|
|
93e6fe |
if (c == 'k') {
|
|
|
93e6fe |
@@ -1727,6 +1732,10 @@ reexecute:
|
|
|
93e6fe |
case s_header_value_lws:
|
|
|
93e6fe |
{
|
|
|
93e6fe |
if (ch == ' ' || ch == '\t') {
|
|
|
93e6fe |
+ if (parser->header_state == h_content_length_num) {
|
|
|
93e6fe |
+ /* treat obsolete line folding as space */
|
|
|
93e6fe |
+ parser->header_state = h_content_length_ws;
|
|
|
93e6fe |
+ }
|
|
|
93e6fe |
UPDATE_STATE(s_header_value_start);
|
|
|
93e6fe |
REEXECUTE();
|
|
|
93e6fe |
}
|
|
|
93e6fe |
diff -up http-parser-2.7.1/test.c.cve http-parser-2.7.1/test.c
|
|
|
93e6fe |
--- http-parser-2.7.1/test.c.cve 2019-03-23 09:08:12.831806096 +0100
|
|
|
93e6fe |
+++ http-parser-2.7.1/test.c 2019-03-23 09:09:45.049875249 +0100
|
|
|
93e6fe |
@@ -3968,6 +3968,20 @@ main (void)
|
|
|
93e6fe |
HPE_INVALID_CONTENT_LENGTH,
|
|
|
93e6fe |
HTTP_REQUEST);
|
|
|
93e6fe |
|
|
|
93e6fe |
+ test_simple_type(
|
|
|
93e6fe |
+ "POST / HTTP/1.1\r\n"
|
|
|
93e6fe |
+ "Content-Length: 42\r\n"
|
|
|
93e6fe |
+ " Hello world!\r\n",
|
|
|
93e6fe |
+ HPE_INVALID_CONTENT_LENGTH,
|
|
|
93e6fe |
+ HTTP_REQUEST);
|
|
|
93e6fe |
+
|
|
|
93e6fe |
+ test_simple_type(
|
|
|
93e6fe |
+ "POST / HTTP/1.1\r\n"
|
|
|
93e6fe |
+ "Content-Length: 42\r\n"
|
|
|
93e6fe |
+ " \r\n",
|
|
|
93e6fe |
+ HPE_OK,
|
|
|
93e6fe |
+ HTTP_REQUEST);
|
|
|
93e6fe |
+
|
|
|
93e6fe |
//// RESPONSES
|
|
|
93e6fe |
|
|
|
93e6fe |
for (i = 0; i < response_count; i++) {
|