client: use base-10 parsing for Content-Length header

strtoul() with base 0 auto-detects octal (leading "0") and
hexadecimal (leading "0x") prefixes. A Content-Length value like
"025" was parsed as octal 21 instead of decimal 25. Since compliant
HTTP frontends always parse Content-Length as decimal per RFC 7230,
this mismatch enables HTTP request smuggling when uhttpd sits behind
a reverse proxy or load balancer.

Fix by explicitly passing base 10 to strtoul().

Reported-by: Nicola Staller <nicola.staller@syss.de>
Signed-off-by: Paul Spooren <mail@aparcar.org>

1 files changed, 1 insertions, 1 deletions

diff --git a/client.c b/client.c
index 1d302d7..4d343fe 100644
--- a/client.c
+++ b/client.c
@@ -391,7 +391,7 @@ static void client_parse_header(struct client *cl, char *data)
 			return;
 		}
 	} else if (!strcmp(data, "content-length")) {
-		r->content_length = strtoul(val, &err, 0);
+		r->content_length = strtoul(val, &err, 10);
 		if ((err && *err) || r->content_length < 0) {
 			uh_header_error(cl, 400, "Bad Request");
 			return;