Author: des
Date: Wed Dec 16 09:17:07 2015
New Revision: 292330
URL: https://svnweb.freebsd.org/changeset/base/292330
Log:
Reset bufpos to 0 immediately after refilling the buffer. Otherwise, we
risk leaving the connection in an indeterminate state if the server fails
to send a chunk delimiter. Depending on the application and on the sizes
of the preceding chunks, the result can be anything from missing data to a
segfault. With this patch, it will be reported as a protocol error.
PR: 204771
MFC after: 1 week
Modified:
head/lib/libfetch/http.c
Modified: head/lib/libfetch/http.c
==============================================================================
--- head/lib/libfetch/http.c Wed Dec 16 09:16:06 2015 (r292329)
+++ head/lib/libfetch/http.c Wed Dec 16 09:17:07 2015 (r292330)
@@ -246,8 +246,9 @@ http_fillbuf(struct httpio *io, size_t l
io->error = errno;
return (-1);
}
+ io->bufpos = 0;
io->buflen = nbytes;
- io->chunksize -= io->buflen;
+ io->chunksize -= nbytes;
if (io->chunksize == 0) {
if (fetch_read(io->conn, &ch, 1) != 1 || ch != '\r' ||
@@ -255,8 +256,6 @@ http_fillbuf(struct httpio *io, size_t l
return (-1);
}
- io->bufpos = 0;
-
return (io->buflen);
}
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
