client: keep request parsing inside the bytes that are actually buffered

2026-11-05T21:36:33Z

The chunked request body parser located line ends with strstr(), which scans the whole read buffer instead of only the bytes the ustream currently holds. When the CRLF terminating a chunk arrived split over two packets, the parser skipped two bytes that were not buffered yet and then matched a CRLF left over from earlier data past the tail of the buffer. Consuming up to that match made ustream_consume() abort the server, so an unauthenticated remote client could kill uhttpd with a crafted chunked request body. Add find_crlf(), which searches for a CR/LF pair within the valid buffer length only, and use it for the request line, the header lines, the chunk size lines and the trailer lines. Also wait for a complete chunk size line before parsing it, and skip chunk extensions as defined by RFC 9112 7.1.1 (BWS, token or quoted-string values) so that valid size lines are not mistaken for malformed framing. Add tests/chunked_body.py, which covers the request shapes from the report, size lines and chunk terminators split across packets, chunk extensions, trailer sections, malformed framing and randomized fragmentation, asserting the received body length and that the server is still alive. Reported-by: Guy Godfroy Signed-off-by: Jo-Philipp Wich

uhttpd/tests/chunked_body.py, branch master

client: keep request parsing inside the bytes that are actually buffered