httpd: More robust Content-length: parsing,

code reorganization (less indented)

1 files changed, 86 insertions, 84 deletions

diff --git a/networking/httpd.c b/networking/httpd.c
index d5cfd652c..71792862e 100644
--- a/networking/httpd.c
+++ b/networking/httpd.c
@@ -256,7 +256,9 @@ static const HttpEnumString httpResponseNames[] = {
 
 
 static const char RFC1123FMT[] = "%a, %d %b %Y %H:%M:%S GMT";
-static const char Content_length[] = "Content-length:";
+
+
+#define STRNCASECMP(a, str) strncasecmp((a), (str), sizeof(str)-1)
 
 
 static int scan_ip(const char **ep, unsigned int *ip, unsigned char endc)
@@ -880,7 +882,7 @@ static int sendHeaders(HttpResponseNum responseNum)
 	if (config->ContentLength != -1) {    /* file */
 		strftime(timeStr, sizeof(timeStr), RFC1123FMT, gmtime(&config->last_mod));
 		len += sprintf(buf+len, "Last-Modified: %s\r\n%s %"OFF_FMT"\r\n",
-				timeStr, Content_length, (off_t) config->ContentLength);
+				timeStr, "Content-length:", (off_t) config->ContentLength);
 	}
 	strcat(buf, "\r\n");
 	len += 2;
@@ -962,20 +964,15 @@ static int sendCgi(const char *url,
 	int outFd;
 	int firstLine = 1;
 
-	do {
-		if (pipe(fromCgi) != 0) {
-			break;
-		}
-		if (pipe(toCgi) != 0) {
-			break;
-		}
-
-		pid = fork();
-		if (pid < 0) {
-			pid = 0;
-			break;
-		}
+	if (pipe(fromCgi) != 0)
+		return 0;
+	if (pipe(toCgi) != 0)
+		return 0;
+	pid = fork();
+	if (pid < 0)
+		return 0;
 
+	do {    
 		if (!pid) {
 			/* child process */
 			char *script;
@@ -1031,10 +1028,9 @@ static int sendCgi(const char *url,
 			if (script != NULL)
 				*script = '\0';         /* reduce /PATH_INFO */
 			 /* SCRIPT_FILENAME required by PHP in CGI mode */
-			if (realpath(purl + 1, realpath_buff))
-				setenv1("SCRIPT_FILENAME", realpath_buff);
-			else
-				*realpath_buff = '\0';
+			if (!realpath(purl + 1, realpath_buff))
+				goto error_execing_cgi;
+			setenv1("SCRIPT_FILENAME", realpath_buff);
 			/* set SCRIPT_NAME as full path: /cgi-bin/dirs/script.cgi */
 			setenv1("SCRIPT_NAME", purl);
 			setenv1("QUERY_STRING", config->query);
@@ -1045,9 +1041,8 @@ static int sendCgi(const char *url,
 #if ENABLE_FEATURE_HTTPD_SET_REMOTE_PORT_TO_ENV
 			setenv_long("REMOTE_PORT", config->port);
 #endif
-			if (bodyLen) {
+			if (bodyLen)
 				setenv_long("CONTENT_LENGTH", bodyLen);
-			}
 			if (cookie)
 				setenv1("HTTP_COOKIE", cookie);
 			if (content_type)
@@ -1064,37 +1059,37 @@ static int sendCgi(const char *url,
 			/* set execve argp[0] without path */
 			argp[0] = strrchr(purl, '/') + 1;
 			/* but script argp[0] must have absolute path and chdiring to this */
-			if (*realpath_buff) {
-				script = strrchr(realpath_buff, '/');
-				if (script) {
-					*script = '\0';
-					if (chdir(realpath_buff) == 0) {
-						// now run the program.  If it fails,
-						// use _exit() so no destructors
-						// get called and make a mess.
+			script = strrchr(realpath_buff, '/');
+			if (!script)
+				goto error_execing_cgi;
+			*script = '\0';
+			if (chdir(realpath_buff) == 0) {
+				// now run the program.  If it fails,
+				// use _exit() so no destructors
+				// get called and make a mess.
 #if ENABLE_FEATURE_HTTPD_CONFIG_WITH_SCRIPT_INTERPR
-						char *interpr = NULL;
-						char *suffix = strrchr(purl, '.');
-
-						if (suffix) {
-							Htaccess * cur;
-							for (cur = config->script_i; cur; cur = cur->next)
-								if (strcmp(cur->before_colon + 1, suffix) == 0) {
-									interpr = cur->after_colon;
-									break;
-								}
+				char *interpr = NULL;
+				char *suffix = strrchr(purl, '.');
+
+				if (suffix) {
+					Htaccess *cur;
+					for (cur = config->script_i; cur; cur = cur->next) {
+						if (strcmp(cur->before_colon + 1, suffix) == 0) {
+							interpr = cur->after_colon;
+							break;
 						}
+					}
+				}
 #endif
-						*script = '/';
+				*script = '/';
 #if ENABLE_FEATURE_HTTPD_CONFIG_WITH_SCRIPT_INTERPR
-						if (interpr)
-							execv(interpr, argp);
-						else
+				if (interpr)
+					execv(interpr, argp);
+				else
 #endif
-							execv(realpath_buff, argp);
-					}
-				}
+					execv(realpath_buff, argp);
 			}
+ error_execing_cgi:
 			/* send to stdout (even if we are not from inetd) */
 			config->accepted_socket = 1;
 			sendHeaders(HTTP_NOT_FOUND);
@@ -1103,7 +1098,7 @@ static int sendCgi(const char *url,
 
 	} while (0);
 
-	if (pid) {
+	if (pid > 0) {
 		/* parent process */
 		int status;
 		size_t post_readed_size = 0, post_readed_idx = 0;
@@ -1425,7 +1420,7 @@ static void handleIncoming(void)
 	int ip_allowed;
 #if ENABLE_FEATURE_HTTPD_CGI
 	const char *prequest = request_GET;
-	long length = 0;
+	unsigned long length = 0;
 	char *cookie = 0;
 	char *content_type = 0;
 #endif
@@ -1452,11 +1447,11 @@ static void handleIncoming(void)
 
 		purl = strpbrk(buf, " \t");
 		if (purl == NULL) {
-BAD_REQUEST:
+ BAD_REQUEST:
 			sendHeaders(HTTP_BAD_REQUEST);
 			break;
 		}
-		*purl = 0;
+		*purl = '\0';
 #if ENABLE_FEATURE_HTTPD_CGI
 		if (strcasecmp(buf, prequest) != 0) {
 			prequest = "POST";
@@ -1487,29 +1482,35 @@ BAD_REQUEST:
 		/* extract url args if present */
 		test = strchr(url, '?');
 		if (test) {
-			*test++ = 0;
+			*test++ = '\0';
 			config->query = test;
 		}
 
 		test = decodeString(url, 0);
 		if (test == NULL)
 			goto BAD_REQUEST;
+		/* FIXME: bug? should be "url+1"? */
 		if (test == (buf+1)) {
 			sendHeaders(HTTP_NOT_FOUND);
 			break;
 		}
+
 		/* algorithm stolen from libbb bb_simplify_path(),
 			 but don't strdup and reducing trailing slash and protect out root */
 		purl = test = url;
-
 		do {
 			if (*purl == '/') {
-				if (*test == '/') {        /* skip duplicate (or initial) slash */
+				/* skip duplicate (or initial) slash */
+				if (*test == '/') {
 					continue;
-				} else if (*test == '.') {
-					if (test[1] == '/' || test[1] == 0) { /* skip extra '.' */
+				}
+				if (*test == '.') {
+					/* skip extra '.' */
+					if (test[1] == '/' || test[1] == 0) {
 						continue;
-					} else if ((test[1] == '.') && (test[2] == '/' || test[2] == 0)) {
+					} else
+					/* '..': be careful */
+					if (test[1] == '.' && (test[2] == '/' || test[2] == 0)) {
 						++test;
 						if (purl == url) {
 							/* protect out root */
@@ -1522,9 +1523,8 @@ BAD_REQUEST:
 			}
 			*++purl = *test;
 		} while (*++test);
-
-		*++purl = 0;        /* so keep last character */
-		test = purl;        /* end ptr */
+		*++purl = '\0';       /* so keep last character */
+		test = purl;          /* end ptr */
 
 		/* If URL is directory, adding '/' */
 		if (test[-1] != '/') {
@@ -1560,36 +1560,40 @@ BAD_REQUEST:
 
 #if ENABLE_FEATURE_HTTPD_CGI
 				/* try and do our best to parse more lines */
-				if ((strncasecmp(buf, Content_length, 15) == 0)) {
-					if (prequest != request_GET)
-						length = strtol(buf + 15, 0, 0); // extra read only for POST
-				} else if ((strncasecmp(buf, "Cookie:", 7) == 0)) {
-					for (test = buf + 7; isspace(*test); test++)
-						  ;
-					cookie = strdup(test);
-				} else if ((strncasecmp(buf, "Content-Type:", 13) == 0)) {
-					for (test = buf + 13; isspace(*test); test++)
-						  ;
-					content_type = strdup(test);
-				} else if ((strncasecmp(buf, "Referer:", 8) == 0)) {
-					for (test = buf + 8; isspace(*test); test++)
-						  ;
-					config->referer = strdup(test);
+				if ((STRNCASECMP(buf, "Content-length:") == 0)) {
+					/* extra read only for POST */
+					if (prequest != request_GET) {
+						test = buf + sizeof("Content-length:")-1;
+						if (!test[0]) goto bail_out;
+						errno = 0;
+						/* not using strtoul: it ignores leading munis! */
+						length = strtol(test, &test, 10);
+						/* length is "ulong", but we need to pass it to int later */
+						/* so we check for negative or too large values in one go: */
+						/* (long -> ulong conv will cause negatives to be seen as > INT_MAX) */
+						if (test[0] || errno || length > INT_MAX)
+							goto bail_out;
+					}
+				} else if ((STRNCASECMP(buf, "Cookie:") == 0)) {
+					cookie = strdup(skip_whitespace(buf + sizeof("Cookie:")-1));
+				} else if ((STRNCASECMP(buf, "Content-Type:") == 0)) {
+					content_type = strdup(skip_whitespace(buf + sizeof("Content-Type:")-1));
+				} else if ((STRNCASECMP(buf, "Referer:") == 0)) {
+					config->referer = strdup(skip_whitespace(buf + sizeof("Referer:")-1));
 				}
 #endif
 
 #if ENABLE_FEATURE_HTTPD_BASIC_AUTH
-				if (strncasecmp(buf, "Authorization:", 14) == 0) {
+				if (STRNCASECMP(buf, "Authorization:") == 0) {
 					/* We only allow Basic credentials.
 					 * It shows up as "Authorization: Basic <userid:password>" where
 					 * the userid:password is base64 encoded.
 					 */
-					for (test = buf + 14; isspace(*test); test++)
-						;
-					if (strncasecmp(test, "Basic", 5) != 0)
+					test = skip_whitespace(buf + sizeof("Authorization:")-1);
+					if (STRNCASECMP(test, "Basic") != 0)
 						continue;
-
-					test += 5;  /* decodeBase64() skiping space self */
+					test += sizeof("Basic")-1;
+					/* decodeBase64() skips whitespace itself */
 					decodeBase64(test);
 					credentials = checkPerm(url, test);
 				}
@@ -1627,10 +1631,6 @@ FORBIDDEN:		/* protect listing /cgi-bin */
 		test = url + 1;      /* skip first '/' */
 
 #if ENABLE_FEATURE_HTTPD_CGI
-		/* if strange Content-Length */
-		if (length < 0)
-			break;
-
 		if (strncmp(test, "cgi-bin", 7) == 0) {
 			if (test[7] == '/' && test[8] == 0)
 				goto FORBIDDEN;     // protect listing cgi-bin/
@@ -1654,6 +1654,8 @@ FORBIDDEN:		/* protect listing /cgi-bin */
 #endif
 	} while (0);
 
+ bail_out:
+
 	if (DEBUG)
 		fprintf(stderr, "closing socket\n\n");
 #if ENABLE_FEATURE_HTTPD_CGI