[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[Libevent-users] [PATCH] Force strict validation of HTTP version in response
Hi,
I ran into this while evhttp was trying to fetch Shoutcast streams.
The server responds with 'ICY 200 OK', which libevent intends to
reject. But the sscanf return value isn't checked properly and the
behaviour is undefined (in practice, sometimes accepts the response,
sometimes rejects it).
For small patches like this, should I just paste the patch in the
message body? It would make it easier to glance at the patch, though
there's a possibility Gmail might mangle the text.
Catalin
From 429903e6385823d780631734a959ddae4401069c Mon Sep 17 00:00:00 2001
From: Catalin Patulea <catalinp@xxxxxxxxxx>
Date: Tue, 10 Jan 2012 18:33:58 -0500
Subject: [PATCH] Force strict validation of HTTP version in response.
This sometimes accepted invalid versions like 'ICY' (n = 0, major = undefined, sometimes > 1).
---
http.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/http.c b/http.c
index 1fccc2c..67b985a 100644
--- a/http.c
+++ b/http.c
@@ -1468,7 +1468,7 @@ evhttp_parse_http_version(const char *version, struct evhttp_request *req)
int major, minor;
char ch;
int n = sscanf(version, "HTTP/%d.%d%c", &major, &minor, &ch);
- if (n > 2 || major > 1) {
+ if (n != 2 || major > 1) {
event_debug(("%s: bad version %s on message %p from %s",
__func__, version, req, req->remote_host));
return (-1);
--
1.7.3.1