Changeset 6646

Timestamp:

Aug 26, 2008, 3:22:00 PM (15 years ago)

Author:

charles

Message:

#1217: libt/shttpd: "shttpd crash in decide_what_to_do()"

Location:

trunk/third-party/shttpd

Files:

• config.h (modified) (1 diff)
• log.c (modified) (5 diffs)
• shttpd.c (modified) (6 diffs)

trunk/third-party/shttpd/config.h

@@ -16 +16 @@
 #define HTPASSWD        ".htpasswd"     /* Passwords file name          */
 #define URI_MAX         16384           /* Default max request size     */
+#define IO_BUFSIZE      65536           /* IO buffer size               */
 #define LISTENING_PORTS "80"            /* Default listening ports      */
 #define INDEX_FILES     "index.html,index.htm,index.php,index.cgi"

trunk/third-party/shttpd/log.c

@@ -17 +17 @@
 _shttpd_elog(int flags, struct conn *c, const char *fmt, ...)
 {
-        char    date[64], buf[URI_MAX];
-        int     len;
         FILE    *fp = c == NULL ? NULL : c->ctx->error_log;
         va_list ap;
@@ -30 +28 @@
         }
 
-        strftime(date, sizeof(date), "%a %b %d %H:%M:%S %Y",
-            localtime(&_shttpd_current_time));
+        if (fp != NULL && (flags & (E_FATAL | E_LOG))) {
+                char    date[64];
+                char    *buf = malloc( URI_MAX );
+                int     len;
 
-        len = _shttpd_snprintf(buf, sizeof(buf),
-            "[%s] [error] [client %s] \"%s\" ",
-            date, c ? inet_ntoa(c->sa.u.sin.sin_addr) : "-",
-            c && c->request ? c->request : "-");
+                strftime(date, sizeof(date), "%a %b %d %H:%M:%S %Y",
+                    localtime(&_shttpd_current_time));
 
-        va_start(ap, fmt);
-        (void) vsnprintf(buf + len, sizeof(buf) - len, fmt, ap);
-        va_end(ap);
+                len = _shttpd_snprintf(buf, URI_MAX,
+                    "[%s] [error] [client %s] \"%s\" ",
+                    date, c ? inet_ntoa(c->sa.u.sin.sin_addr) : "-",
+                    c && c->request ? c->request : "-");
 
-        buf[sizeof(buf) - 1] = '\0';
+                va_start(ap, fmt);
+                (void) vsnprintf(buf + len, URI_MAX - len, fmt, ap);
+                va_end(ap);
 
-        if (fp != NULL && (flags & (E_FATAL | E_LOG))) {
+                buf[URI_MAX - 1] = '\0';
+
                 (void) fprintf(fp, "%s\n", buf);
                 (void) fflush(fp);
+
+                free(buf);
         }
 
@@ -58 +62 @@
         static const struct vec dash = {"-", 1};
 
-        const struct vec        *user = &c->ch.user.v_vec;
-        const struct vec        *referer = &c->ch.referer.v_vec;
-        const struct vec        *user_agent = &c->ch.useragent.v_vec;
-        char                    date[64], buf[URI_MAX], *q1 = "\"", *q2 = "\"";
+        const struct vec        *user;
+        const struct vec        *referer;
+        const struct vec        *user_agent;
+        char                    date[64], *buf, *q1, *q2;
+
+        if (fp == NULL)
+                return;
+
+        user = &c->ch.user.v_vec;
+        referer = &c->ch.referer.v_vec;
+        user_agent = &c->ch.useragent.v_vec;
+        q1 = q2 = "\"";
 
         if (user->len == 0)
@@ -79 +91 @@
                         localtime(&c->birth_time));
 
-        (void) _shttpd_snprintf(buf, sizeof(buf),
+        buf = malloc(URI_MAX);
+
+        (void) _shttpd_snprintf(buf, URI_MAX,
             "%s - %.*s [%s %+05d] \"%s\" %d %lu %s%.*s%s %s%.*s%s",
             inet_ntoa(c->sa.u.sin.sin_addr), user->len, user->ptr,
@@ -87 +101 @@
             q2, user_agent->len, user_agent->ptr, q2);
 
-        if (fp != NULL) {
-                (void) fprintf(fp, "%s\n", buf);
-                (void) fflush(fp);
-        }
+        (void) fprintf(fp, "%s\n", buf);
+        (void) fflush(fp);
+
+        free(buf);
 }

trunk/third-party/shttpd/shttpd.c

@@ -534 +534 @@
 decide_what_to_do(struct conn *c)
 {
-        char            path[URI_MAX], buf[1024], *root;
+        char            *path;
+        const char      *root;
         struct vec      alias_uri, alias_path;
         struct stat     st;
@@ -549 +550 @@
         
         root = c->ctx->options[OPT_ROOT];
-        if (strlen(c->uri) + strlen(root) >= sizeof(path)) {
+        if (strlen(c->uri) + strlen(root) >= URI_MAX) {
                 _shttpd_send_server_error(c, 400, "URI is too long");
                 return;
         }
 
-        (void) _shttpd_snprintf(path, sizeof(path), "%s%s", root, c->uri);
+        path = malloc( URI_MAX );
+        (void) _shttpd_snprintf(path, URI_MAX, "%s%s", root, c->uri);
 
         /* User may use the aliases - check URI for mount point */
         if (is_alias(c->ctx, c->uri, &alias_uri, &alias_path) != NULL) {
-                (void) _shttpd_snprintf(path, sizeof(path), "%.*s%s",
+                (void) _shttpd_snprintf(path, URI_MAX, "%.*s%s",
                     alias_path.len, alias_path.ptr, c->uri + alias_uri.len);
                 DBG(("using alias %.*s -> %.*s", alias_uri.len, alias_uri.ptr,
@@ -613 +615 @@
                 _shttpd_send_server_error(c, 404, "Not Found");
         } else if (S_ISDIR(st.st_mode) && path[strlen(path) - 1] != '/') {
+                char buf[1024];
                 (void) _shttpd_snprintf(buf, sizeof(buf),
                         "Moved Permanently\r\nLocation: %s/", c->uri);
                 _shttpd_send_server_error(c, 301, buf);
         } else if (S_ISDIR(st.st_mode) &&
-            find_index_file(c, path, sizeof(path) - 1, &st) == -1 &&
+            find_index_file(c, path, URI_MAX - 1, &st) == -1 &&
             !IS_TRUE(c->ctx, OPT_DIR_LIST)) {
                 _shttpd_send_server_error(c, 403, "Directory Listing Denied");
@@ -656 +659 @@
                 _shttpd_send_server_error(c, 500, "Internal Error");
         }
+
+        free(path);
 }
 
@@ -782 +787 @@
                 SSL_free(ssl);
 #endif /* NO_SSL */
-        } else if ((c = calloc(1, sizeof(*c) + 2 * URI_MAX)) == NULL) {
+        } else if ((c = calloc(1, sizeof(*c) + 2 * IO_BUFSIZE)) == NULL) {
 #if !defined(NO_SSL)
                 if (ssl)
@@ -809 +814 @@
                 /* Set IO buffers */
                 c->loc.io.buf   = (char *) (c + 1);
-                c->rem.io.buf   = c->loc.io.buf + URI_MAX;
-                c->loc.io.size  = c->rem.io.size = URI_MAX;
+                c->rem.io.buf   = c->loc.io.buf + IO_BUFSIZE;
+                c->loc.io.size  = c->rem.io.size = IO_BUFSIZE;
 
 #if !defined(NO_SSL)