libevhtp icon indicating copy to clipboard operation
libevhtp copied to clipboard

Serious issue in parser.c introduced in 3294cf4

Open derekmauro opened this issue 6 years ago • 0 comments

Commit 3294cf4 commented out this line for no clear reason. https://github.com/criticalstack/libevhtp/blob/3294cf469fa2700b349f7621e6a6823d106825de/parser.c#L571-L572 Note that this line does not memset the buffer. It memsets the structure up until the buffer.

The result is that when htparser_run() is run, it should be pretty easy to see that buf_idx is used uninitialized here (when you expand the macro): https://github.com/criticalstack/libevhtp/blob/3294cf469fa2700b349f7621e6a6823d106825de/parser.c#L786

I suspect this is the actual cause of several recently reported issues. It also seems that the htparse_error_too_big is not handled properly, because if I send enough requests, the server becomes unresponsive, but I didn't try to diagnose exactly why.

derekmauro avatar Apr 02 '19 02:04 derekmauro