Skip to content
This repository was archived by the owner on Nov 6, 2022. It is now read-only.

Commit f6f436a

Browse files
Daniel Knoppel (Phusion)indutny
authored andcommitted
src: fix invalid memory access in http_parse_host
http_parse_host() depends on `u->field_data[UF_HOST]`, but this if() allowed the method to be called if only `u->field_data[UF_SCHEMA]` was set, resulting in use of unintialized pointers. PR-URL: #246 Reviewed-By: Fedor Indutny <[email protected]>
1 parent 2896229 commit f6f436a

File tree

1 file changed

+7
-1
lines changed

1 file changed

+7
-1
lines changed

http_parser.c

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2232,6 +2232,7 @@ http_parse_host_char(enum http_host_state s, const char ch) {
22322232

22332233
static int
22342234
http_parse_host(const char * buf, struct http_parser_url *u, int found_at) {
2235+
assert(u->field_set & (1 << UF_HOST));
22352236
enum http_host_state s;
22362237

22372238
const char *p;
@@ -2376,7 +2377,12 @@ http_parser_parse_url(const char *buf, size_t buflen, int is_connect,
23762377

23772378
/* host must be present if there is a schema */
23782379
/* parsing http:///toto will fail */
2379-
if ((u->field_set & ((1 << UF_SCHEMA) | (1 << UF_HOST))) != 0) {
2380+
if ((u->field_set & (1 << UF_SCHEMA)) &&
2381+
(u->field_set & (1 << UF_HOST)) == 0) {
2382+
return 1;
2383+
}
2384+
2385+
if (u->field_set & (1 << UF_HOST)) {
23802386
if (http_parse_host(buf, u, found_at) != 0) {
23812387
return 1;
23822388
}

0 commit comments

Comments
 (0)