[Asterisk-code-review] http.c: Give HTTP error response when received lines are too... (asterisk[13])

[Richard Mudgett]

Richard Mudgett has uploaded this change for review. ( https://gerrit.asterisk.org/10030


Change subject: http.c: Give HTTP error response when received lines are too long.
......................................................................

http.c: Give HTTP error response when received lines are too long.

Added a check when we receive a HTTP request line or header line that is
too long.  We now return an error response to the sender because we are
not able to process the request.

Change-Id: I6df2705435fd7dde4d5d3bdf7acec859cfb7c12d
---
M main/http.c
1 file changed, 17 insertions(+), 0 deletions(-)



  git pull ssh://gerrit.asterisk.org:29418/asterisk refs/changes/30/10030/1

diff --git a/main/http.c b/main/http.c
index e8d395b..15c6da2 100644
--- a/main/http.c
+++ b/main/http.c
@@ -1772,6 +1772,7 @@
 
 	remaining_headers = MAX_HTTP_REQUEST_HEADERS;
 	for (;;) {
+		size_t len;
 		char *name;
 		char *value;
 
@@ -1779,6 +1780,13 @@
 			ast_http_error(ser, 400, "Bad Request", "Timeout");
 			return -1;
 		}
+		len = strlen(header_line);
+		if (!len || header_line[len - 1] != '\n') {
+			/* We didn't get a full line */
+			ast_http_error(ser, 400, "Bad Request",
+				(len == sizeof(header_line) - 1) ? "Header line too long" : "Timeout");
+			return -1;
+		}
 
 		/* Trim trailing characters */
 		ast_trim_blanks(header_line);
@@ -1847,6 +1855,7 @@
 	struct http_worker_private_data *request;
 	enum ast_http_method http_method = AST_HTTP_UNKNOWN;
 	int res;
+	size_t len;
 	char request_line[MAX_HTTP_LINE_LENGTH];
 
 	if (!fgets(request_line, sizeof(request_line), ser->f)) {
@@ -1857,6 +1866,14 @@
 	request = ser->private_data;
 	http_request_tracking_init(request);
 
+	len = strlen(request_line);
+	if (!len || request_line[len - 1] != '\n') {
+		/* We didn't get a full line */
+		ast_http_error(ser, 400, "Bad Request",
+			(len == sizeof(request_line) - 1) ? "Request line too long" : "Timeout");
+		return -1;
+	}
+
 	/* Get method */
 	method = ast_skip_blanks(request_line);
 	uri = ast_skip_nonblanks(method);

-- 
To view, visit https://gerrit.asterisk.org/10030
To unsubscribe, or for help writing mail filters, visit https://gerrit.asterisk.org/settings

Gerrit-Project: asterisk
Gerrit-Branch: 13
Gerrit-MessageType: newchange
Gerrit-Change-Id: I6df2705435fd7dde4d5d3bdf7acec859cfb7c12d
Gerrit-Change-Number: 10030
Gerrit-PatchSet: 1
Gerrit-Owner: Richard Mudgett <rmudgett at digium.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-code-review/attachments/20180830/0fbca9fd/attachment.html>