main: fix two one-byte overreads in header_value()

[project/cgi-io.git] / main.c

diff --git a/main.c b/main.c
index ff9bb63f5cd8fabbb91aa06c61095c93379e8189..8ca4c046d96eefe88aa8221e93814d0de7a0994c 100644 (file)
--- a/main.c
+++ b/main.c
@@ -72,6 +72,10 @@ struct state
        int tempfd;
 };
 
+static struct state st;
+
+#ifndef UNIT_TESTING
+
 enum {
        SES_ACCESS,
        __SES_MAX,
@@ -81,9 +85,6 @@ static const struct blobmsg_policy ses_policy[__SES_MAX] = {
        [SES_ACCESS] = { .name = "access", .type = BLOBMSG_TYPE_BOOL },
 };
 
-
-static struct state st;
-
 static void
 session_access_cb(struct ubus_request *req, int type, struct blob_attr *msg)
 {
@@ -98,10 +99,14 @@ session_access_cb(struct ubus_request *req, int type, struct blob_attr *msg)
        if (tb[SES_ACCESS])
                *allow = blobmsg_get_bool(tb[SES_ACCESS]);
 }
+#endif
 
 static bool
 session_access(const char *sid, const char *scope, const char *obj, const char *func)
 {
+#ifdef UNIT_TESTING
+       return true;
+#else
        uint32_t id;
        bool allow = false;
        struct ubus_context *ctx;
@@ -125,6 +130,7 @@ out:
                ubus_free(ctx);
 
        return allow;
+#endif
 }
 
 static char *
@@ -308,21 +314,21 @@ header_value(multipart_parser *p, const char *data, size_t len)
        if (len < 10 || strncasecmp(data, "form-data", 9))
                return 0;
 
-       for (data += 9, len -= 9; *data == ' ' || *data == ';'; data++, len--);
+       for (data += 9, len -= 9; len > 0 && (*data == ' ' || *data == ';'); data++, len--);
 
        if (len < 8 || strncasecmp(data, "name=\"", 6))
                return 0;
 
-       for (data += 6, len -= 6, i = 0; i <= len; i++)
+       for (data += 6, len -= 6, i = 1; i < len; i++)
        {
-               if (*(data + i) != '"')
-                       continue;
-
-               for (j = 1; j < sizeof(parts) / sizeof(parts[0]); j++)
-                       if (!strncmp(data, parts[j], i))
-                               st.parttype = j;
+               if (data[i] == '"')
+               {
+                       for (j = 1; j < sizeof(parts) / sizeof(parts[0]); j++)
+                               if (!strncmp(data, parts[j], i - 1))
+                                       st.parttype = j;
 
-               break;
+                       break;
+               }
        }
 
        return 0;
@@ -666,7 +672,7 @@ main_backup(int argc, char **argv)
 
                do {
                        len = splice(fds[0], NULL, 1, NULL, READ_BLOCK, SPLICE_F_MORE);
-               } while (len > 0);
+               } while (len > 0 || (len == -1 && errno == EINTR));
 
                waitpid(pid, &status, 0);
 
@@ -830,7 +836,7 @@ main_exec(int argc, char **argv)
 
                do {
                        len = splice(fds[0], NULL, 1, NULL, READ_BLOCK, SPLICE_F_MORE);
-               } while (len > 0);
+               } while (len > 0 || (len == -1 && errno == EINTR));
 
                waitpid(pid, &status, 0);