client: fix invalid data access through invalid content-length values

[project/uhttpd.git] / client.c

diff --git a/client.c b/client.c
index 73e0e49c3bf55bbeb40c6018db482d4c91d81950..92f760937a12ea207b10fc872401cab05f475e6b 100644 (file)
--- a/client.c
+++ b/client.c
@@ -40,13 +40,18 @@ const char * const http_methods[] = {
        [UH_HTTP_MSG_POST] = "POST",
        [UH_HTTP_MSG_HEAD] = "HEAD",
        [UH_HTTP_MSG_OPTIONS] = "OPTIONS",
+       [UH_HTTP_MSG_PUT] = "PUT",
+       [UH_HTTP_MSG_PATCH] = "PATCH",
+       [UH_HTTP_MSG_DELETE] = "DELETE",
 };
 
 void uh_http_header(struct client *cl, int code, const char *summary)
 {
        struct http_request *r = &cl->request;
+       struct blob_attr *cur;
        const char *enc = "Transfer-Encoding: chunked\r\n";
        const char *conn;
+       int rem;
 
        cl->http_code = code;
 
@@ -64,6 +69,10 @@ void uh_http_header(struct client *cl, int code, const char *summary)
 
        if (!r->connection_close)
                ustream_printf(cl->us, "Keep-Alive: timeout=%d\r\n", conf.http_keepalive);
+
+       blobmsg_for_each_attr(cur, cl->hdr_response.head, rem)
+               ustream_printf(cl->us, "%s: %s\r\n", blobmsg_name(cur),
+                              blobmsg_get_string(cur));
 }
 
 static void uh_connection_close(struct client *cl)
@@ -114,6 +123,7 @@ void uh_request_done(struct client *cl)
 {
        uh_chunk_eof(cl);
        uh_dispatch_done(cl);
+       blob_buf_init(&cl->hdr_response, 0);
        memset(&cl->dispatch, 0, sizeof(cl->dispatch));
 
        if (!conf.http_keepalive || cl->request.connection_close)
@@ -336,7 +346,7 @@ static void client_parse_header(struct client *cl, char *data)
                }
        } else if (!strcmp(data, "content-length")) {
                r->content_length = strtoul(val, &err, 0);
-               if (err && *err) {
+               if ((err && *err) || r->content_length < 0) {
                        uh_header_error(cl, 400, "Bad Request");
                        return;
                }
@@ -434,7 +444,7 @@ void client_poll_post_data(struct client *cl)
                ustream_consume(cl->us, sep + 2 - buf);
 
                /* invalid chunk length */
-               if (sep && *sep) {
+               if ((sep && *sep) || r->content_length < 0) {
                        r->content_length = 0;
                        r->transfer_chunked = 0;
                        break;
@@ -530,6 +540,7 @@ static void client_close(struct client *cl)
        close(cl->sfd.fd.fd);
        list_del(&cl->list);
        blob_buf_free(&cl->hdr);
+       blob_buf_free(&cl->hdr_response);
        free(cl);
 
        uh_unblock_listeners();
@@ -545,6 +556,14 @@ void uh_client_notify_state(struct client *cl)
 
                if (!s->eof || s->w.data_bytes)
                        return;
+
+#ifdef HAVE_TLS
+               if (cl->tls && cl->ssl.conn && cl->ssl.conn->w.data_bytes) {
+                       cl->ssl.conn->eof = s->eof;
+                       if (!ustream_write_pending(cl->ssl.conn))
+                               return;
+               }
+#endif
        }
 
        return client_close(cl);