httpd shrink and logging update, part 5 of 7

   text    data     bss     dec     hex filename
   9836       0       0    9836    266c busybox.t1/networking/httpd.o.orig
   9724       0       0    9724    25fc busybox.t2/networking/httpd.o
   9657       0       0    9657    25b9 busybox.t3/networking/httpd.o
   9342       0       0    9342    247e busybox.t4/networking/httpd.o
   9342       0       0    9342    247e busybox.t5/networking/httpd.o
   9262       0       0    9262    242e busybox.t6/networking/httpd.o
   9283       0       0    9283    2443 busybox.t7/networking/httpd.o
   9334       0       0    9334    2476 busybox.t8/networking/httpd.o

1 files changed, 198 insertions, 214 deletions

diff --git a/networking/httpd.c b/networking/httpd.c
index 69d994a47..81660b2e6 100644
--- a/networking/httpd.c
+++ b/networking/httpd.c
@@ -20,7 +20,7 @@
  * httpd -p 80 -u 80 -h /www -c /etc/httpd.conf -r "Web Server Authentication"
  *
  *
- * When a url contains "cgi-bin" it is assumed to be a cgi script.  The
+ * When a url starts by "/cgi-bin/" it is assumed to be a cgi script.  The
  * server changes directory to the location of the script and executes it
  * after setting QUERY_STRING and other environment variables.
  *
@@ -89,44 +89,45 @@
  * root configuration file.  If -c is set and the file is not found, the
  * server exits with an error.
  *
-*/
+ */
 
 #include "libbb.h"
 #if ENABLE_FEATURE_HTTPD_USE_SENDFILE
 #include <sys/sendfile.h>
 #endif
 
+//#define DEBUG 1
+#define DEBUG 0
+
 /* amount of buffering in a pipe */
 #ifndef PIPE_BUF
 # define PIPE_BUF 4096
 #endif
 
-static const char default_path_httpd_conf[] ALIGN1 = "/etc";
-static const char httpd_conf[] ALIGN1 = "httpd.conf";
-
-#define TIMEOUT 60
+#define MAX_MEMORY_BUF 8192    /* IO buffer */
 
-// Note: busybox xfuncs are not used because we want the server to keep running
-// if something bad happens due to a malformed user request.
-// As a result, all memory allocations after daemonize
-// are checked rigorously
+#define HEADER_READ_TIMEOUT 60
 
-//#define DEBUG 1
-#define DEBUG 0
+static const char default_path_httpd_conf[] ALIGN1 = "/etc";
+static const char httpd_conf[] ALIGN1 = "httpd.conf";
 
-#define MAX_MEMORY_BUF 8192    /* IO buffer */
+typedef struct has_next_ptr {
+        struct has_next_ptr *next;
+} has_next_ptr;
 
+/* Must have "next" as a first member */
 typedef struct Htaccess {
-        char *after_colon;
         struct Htaccess *next;
+        char *after_colon;
         char before_colon[1];  /* really bigger, must be last */
 } Htaccess;
 
+/* Must have "next" as a first member */
 typedef struct Htaccess_IP {
+        struct Htaccess_IP *next;
         unsigned ip;
         unsigned mask;
         int allow_deny;
-        struct Htaccess_IP *next;
 } Htaccess_IP;
 
 struct globals {
@@ -199,30 +200,6 @@ struct globals {
         ContentLength = -1; \
 } while (0)
 
-static const char request_GET[] ALIGN1 = "GET";    /* size algorithmic optimize */
-
-static const char *const suffixTable[] = {
-/* Warning: shorter equivalent suffix in one line must be first */
-        ".htm.html", "text/html",
-        ".jpg.jpeg", "image/jpeg",
-        ".gif", "image/gif",
-        ".png", "image/png",
-        ".txt.h.c.cc.cpp", "text/plain",
-        ".css", "text/css",
-        ".wav", "audio/wav",
-        ".avi", "video/x-msvideo",
-        ".qt.mov", "video/quicktime",
-        ".mpe.mpeg", "video/mpeg",
-        ".mid.midi", "audio/midi",
-        ".mp3", "audio/mpeg",
-#if 0                        /* unpopular */
-        ".au", "audio/basic",
-        ".pac", "application/x-ns-proxy-autoconfig",
-        ".vrml.wrl", "model/vrml",
-#endif
-        0, "application/octet-stream" /* default */
-};
-
 typedef enum {
         HTTP_OK = 200,
         HTTP_MOVED_TEMPORARILY = 302,
@@ -285,11 +262,32 @@ static const HttpEnumString httpResponseNames[] = {
 };
 
 
-static const char RFC1123FMT[] ALIGN1 = "%a, %d %b %Y %H:%M:%S GMT";
+#define STRNCASECMP(a, str) strncasecmp((a), (str), sizeof(str)-1)
 
+static void free_llist(has_next_ptr **pptr)
+{
+        has_next_ptr *cur = *pptr;
+        while (cur) {
+                has_next_ptr *t = cur;
+                cur = cur->next;
+                free(t);
+        }
+        *pptr = NULL;
+}
 
-#define STRNCASECMP(a, str) strncasecmp((a), (str), sizeof(str)-1)
+#if ENABLE_FEATURE_HTTPD_BASIC_AUTH \
+ || ENABLE_FEATURE_HTTPD_CONFIG_WITH_MIME_TYPES \
+ || ENABLE_FEATURE_HTTPD_CONFIG_WITH_SCRIPT_INTERPR
+static ALWAYS_INLINE void free_Htaccess_list(Htaccess **pptr)
+{
+        free_llist((has_next_ptr**)pptr);
+}
+#endif
 
+static ALWAYS_INLINE void free_Htaccess_IP_list(Htaccess_IP **pptr)
+{
+        free_llist((has_next_ptr**)pptr);
+}
 
 static int scan_ip(const char **ep, unsigned *ip, unsigned char endc)
 {
@@ -365,33 +363,8 @@ static int scan_ip_mask(const char *ipm, unsigned *ip, unsigned *mask)
         return 0;
 }
 
-#if ENABLE_FEATURE_HTTPD_BASIC_AUTH \
- || ENABLE_FEATURE_HTTPD_CONFIG_WITH_MIME_TYPES \
- || ENABLE_FEATURE_HTTPD_CONFIG_WITH_SCRIPT_INTERPR
-static void free_config_lines(Htaccess **pprev)
-{
-        Htaccess *prev = *pprev;
-
-        while (prev) {
-                Htaccess *cur = prev;
-
-                prev = cur->next;
-                free(cur);
-        }
-        *pprev = NULL;
-}
-#endif
-
-/* flag */
-#define FIRST_PARSE          0
-#define SUBDIR_PARSE         1
-#define SIGNALED_PARSE       2
-#define FIND_FROM_HTTPD_ROOT 3
-/****************************************************************************
- *
- > $Function: parse_conf()
- *
- * $Description: parse configuration file into in-memory linked list.
+/*
+ * Parse configuration file into in-memory linked list.
  *
  * The first non-white character is examined to determine if the config line
  * is one of the following:
@@ -404,14 +377,14 @@ static void free_config_lines(Htaccess **pprev)
  * are also discarded.  That is, previous settings are retained if flag is
  * SUBDIR_PARSE.
  *
- * $Parameters:
- *      (const char *) path . . null for ip address checks, path for password
- *                              checks.
- *      (int) flag  . . . . . . the source of the parse request.
- *
- * $Return: (None)
- *
- ****************************************************************************/
+ * path   Path where to look for httpd.conf (without filename).
+ * flag   Type of the parse request.
+ */
+/* flag */
+#define FIRST_PARSE          0
+#define SUBDIR_PARSE         1
+#define SIGNALED_PARSE       2
+#define FIND_FROM_HTTPD_ROOT 3
 static void parse_conf(const char *path, int flag)
 {
         FILE *f;
@@ -423,38 +396,28 @@ static void parse_conf(const char *path, int flag)
  || ENABLE_FEATURE_HTTPD_CONFIG_WITH_SCRIPT_INTERPR
         Htaccess *cur;
 #endif
-
         const char *cf = configFile;
         char buf[160];
         char *p0 = NULL;
         char *c, *p;
+        Htaccess_IP *pip;
 
-        /* free previous ip setup if present */
-        Htaccess_IP *pip = ip_a_d;
-
-        while (pip) {
-                Htaccess_IP *cur_ipl = pip;
-
-                pip = cur_ipl->next;
-                free(cur_ipl);
-        }
-        ip_a_d = NULL;
-
+        /* discard old rules */
+        free_Htaccess_IP_list(&ip_a_d);
         flg_deny_all = 0;
-
 #if ENABLE_FEATURE_HTTPD_BASIC_AUTH \
  || ENABLE_FEATURE_HTTPD_CONFIG_WITH_MIME_TYPES \
  || ENABLE_FEATURE_HTTPD_CONFIG_WITH_SCRIPT_INTERPR
         /* retain previous auth and mime config only for subdir parse */
         if (flag != SUBDIR_PARSE) {
 #if ENABLE_FEATURE_HTTPD_BASIC_AUTH
-                free_config_lines(&g_auth);
+                free_Htaccess_list(&g_auth);
 #endif
 #if ENABLE_FEATURE_HTTPD_CONFIG_WITH_MIME_TYPES
-                free_config_lines(&mime_a);
+                free_Htaccess_list(&mime_a);
 #endif
 #if ENABLE_FEATURE_HTTPD_CONFIG_WITH_SCRIPT_INTERPR
-                free_config_lines(&script_i);
+                free_Htaccess_list(&script_i);
 #endif
         }
 #endif
@@ -463,7 +426,7 @@ static void parse_conf(const char *path, int flag)
                 cf = alloca(strlen(path) + sizeof(httpd_conf) + 2);
                 if (cf == NULL) {
                         if (flag == FIRST_PARSE)
-                        bb_error_msg_and_die(bb_msg_memory_exhausted);
+                                bb_error_msg_and_die(bb_msg_memory_exhausted);
                         return;
                 }
                 sprintf((char *)cf, "%s/%s", path, httpd_conf);
@@ -486,21 +449,21 @@ static void parse_conf(const char *path, int flag)
         /* This could stand some work */
         while ((p0 = fgets(buf, sizeof(buf), f)) != NULL) {
                 c = NULL;
-                for (p = p0; *p0 != 0 && *p0 != '#'; p0++) {
+                for (p = p0; *p0 != '\0' && *p0 != '#'; p0++) {
                         if (!isspace(*p0)) {
                                 *p++ = *p0;
                                 if (*p0 == ':' && c == NULL)
-                                c = p;
+                                        c = p;
                         }
                 }
-                *p = 0;
+                *p = '\0';
 
                 /* test for empty or strange line */
-                if (c == NULL || *c == 0)
+                if (c == NULL || *c == '\0')
                         continue;
                 p0 = buf;
                 if (*p0 == 'd')
-                                *p0 = 'D';
+                        *p0 = 'D';
                 if (*c == '*') {
                         if (*p0 == 'D') {
                                 /* memorize deny all */
@@ -535,7 +498,7 @@ static void parse_conf(const char *path, int flag)
                                 }
                                 pip->allow_deny = *p0;
                                 if (*p0 == 'D') {
-                                        /* Deny:form_IP move top */
+                                        /* Deny:from_IP move top */
                                         pip->next = ip_a_d;
                                         ip_a_d = pip;
                                 } else {
@@ -555,12 +518,12 @@ static void parse_conf(const char *path, int flag)
                 }
 #if ENABLE_FEATURE_HTTPD_BASIC_AUTH
                 if (*p0 == '/') {
-                        /* make full path from httpd root / curent_path / config_line_path */
-                        cf = flag == SUBDIR_PARSE ? path : "";
+                        /* make full path from httpd root / current_path / config_line_path */
+                        cf = (flag == SUBDIR_PARSE ? path : "");
                         p0 = malloc(strlen(cf) + (c - buf) + 2 + strlen(c));
                         if (p0 == NULL)
                                 continue;
-                        c[-1] = 0;
+                        c[-1] = '\0';
                         sprintf(p0, "/%s%s", cf, buf);
 
                         /* another call bb_simplify_path */
@@ -571,9 +534,9 @@ static void parse_conf(const char *path, int flag)
                                         if (*cf == '/') {    /* skip duplicate (or initial) slash */
                                                 continue;
                                         } else if (*cf == '.') {
-                                                if (cf[1] == '/' || cf[1] == 0) { /* remove extra '.' */
+                                                if (cf[1] == '/' || cf[1] == '\0') { /* remove extra '.' */
                                                         continue;
-                                                } else if ((cf[1] == '.') && (cf[2] == '/' || cf[2] == 0)) {
+                                                } else if ((cf[1] == '.') && (cf[2] == '/' || cf[2] == '\0')) {
                                                         ++cf;
                                                         if (p > p0) {
                                                                 while (*--p != '/') /* omit previous dir */;
@@ -588,7 +551,7 @@ static void parse_conf(const char *path, int flag)
                         if ((p == p0) || (*p != '/')) {      /* not a trailing slash */
                                 ++p;                             /* so keep last character */
                         }
-                        *p = 0;
+                        *p = '\0';
                         sprintf(p0, "%s:%s", p0, c);
                 }
 #endif
@@ -658,23 +621,14 @@ static void parse_conf(const char *path, int flag)
 }
 
 #if ENABLE_FEATURE_HTTPD_ENCODE_URL_STR
-/****************************************************************************
- *
- > $Function: encodeString()
- *
- * $Description: Given a string, html encode special characters.
- *   This is used for the -e command line option to provide an easy way
- *   for scripts to encode result data without confusing browsers.  The
- *   returned string pointer is memory allocated by malloc().
- *
- * $Parameters:
- *      (const char *) string . . The first string to encode.
- *
- * $Return: (char *) . . . .. . . A pointer to the encoded string.
- *
- * $Errors: Returns a null string ("") if memory is not available.
+/*
+ * Given a string, html-encode special characters.
+ * This is used for the -e command line option to provide an easy way
+ * for scripts to encode result data without confusing browsers.  The
+ * returned string pointer is memory allocated by malloc().
  *
- ****************************************************************************/
+ * Returns a pointer to the encoded string (malloced).
+ */
 static char *encodeString(const char *string)
 {
         /* take the simple route and encode everything */
@@ -694,25 +648,18 @@ static char *encodeString(const char *string)
 }
 #endif          /* FEATURE_HTTPD_ENCODE_URL_STR */
 
-/****************************************************************************
- *
- > $Function: decodeString()
- *
- * $Description: Given a URL encoded string, convert it to plain ascii.
- *   Since decoding always makes strings smaller, the decode is done in-place.
- *   Thus, callers should strdup() the argument if they do not want the
- *   argument modified.  The return is the original pointer, allowing this
- *   function to be easily used as arguments to other functions.
- *
- * $Parameters:
- *      (char *) string . . . The first string to decode.
- *      (int)    option_d . . 1 if called for httpd -d
- *
- * $Return: (char *)  . . . . A pointer to the decoded string (same as input).
+/*
+ * Given a URL encoded string, convert it to plain ascii.
+ * Since decoding always makes strings smaller, the decode is done in-place.
+ * Thus, callers should strdup() the argument if they do not want the
+ * argument modified.  The return is the original pointer, allowing this
+ * function to be easily used as arguments to other functions.
  *
- * $Errors: None
+ * string    The first string to decode.
+ * option_d  1 if called for httpd -d
  *
- ****************************************************************************/
+ * Returns a pointer to the decoded string (same as input).
+ */
 static char *decodeString(char *orig, int option_d)
 {
         /* note that decoded string is always shorter than original */
@@ -754,9 +701,9 @@ static char *decodeString(char *orig, int option_d)
 
 
 #if ENABLE_FEATURE_HTTPD_CGI
-/****************************************************************************
+/*
  * setenv helpers
- ****************************************************************************/
+ */
 static void setenv1(const char *name, const char *value)
 {
         if (!value)
@@ -773,10 +720,10 @@ static void setenv_long(const char *name, long value)
 
 #if ENABLE_FEATURE_HTTPD_BASIC_AUTH
 /*
- * Decode a base 64 data stream as per rfc1521.
+ * Decode a base64 data stream as per rfc1521.
  * Note that the rfc states that non base64 chars are to be ignored.
- * Since the decode always results in a shorter size than the input, it is
- * OK to pass the input arg as an output arg.
+ * Since the decode always results in a shorter size than the input,
+ * it is OK to pass the input arg as an output arg.
  * Parameter: a pointer to a base64 encoded string.
  * Decoded data is stored in-place.
  */
@@ -818,18 +765,9 @@ static void decodeBase64(char *Data)
 }
 #endif
 
-
-/****************************************************************************
- *
- > $Function: openServer()
- *
- * $Description: create a listen server socket on the designated port.
- *
- * $Return: (int)  . . . A connection socket. -1 for errors.
- *
- * $Errors: None
- *
- ****************************************************************************/
+/*
+ * Create a listen server socket on the designated port.
+ */
 #if BB_MMU
 static int openServer(void)
 {
@@ -853,6 +791,8 @@ static int openServer(void)
  */
 static int sendHeaders(HttpResponseNum responseNum)
 {
+        static const char RFC1123FMT[] ALIGN1 = "%a, %d %b %Y %H:%M:%S GMT";
+
         const char *responseString = "";
         const char *infoString = NULL;
         const char *mime_type;
@@ -1318,6 +1258,28 @@ static void send_cgi_and_exit(
 static void send_file_and_exit(const char *url) ATTRIBUTE_NORETURN;
 static void send_file_and_exit(const char *url)
 {
+        static const char *const suffixTable[] = {
+        /* Warning: shorter equivalent suffix in one line must be first */
+                ".htm.html", "text/html",
+                ".jpg.jpeg", "image/jpeg",
+                ".gif",      "image/gif",
+                ".png",      "image/png",
+                ".txt.h.c.cc.cpp", "text/plain",
+                ".css",      "text/css",
+                ".wav",      "audio/wav",
+                ".avi",      "video/x-msvideo",
+                ".qt.mov",   "video/quicktime",
+                ".mpe.mpeg", "video/mpeg",
+                ".mid.midi", "audio/midi",
+                ".mp3",      "audio/mpeg",
+#if 0                        /* unpopular */
+                ".au",       "audio/basic",
+                ".pac",      "application/x-ns-proxy-autoconfig",
+                ".vrml.wrl", "model/vrml",
+#endif
+                NULL
+        };
+
         char *suffix;
         int f;
         int fd;
@@ -1330,25 +1292,31 @@ static void send_file_and_exit(const char *url)
 
         suffix = strrchr(url, '.');
 
-        for (table = suffixTable; *table; table += 2)
-                if (suffix != NULL && (try_suffix = strstr(*table, suffix)) != 0) {
-                        try_suffix += strlen(suffix);
-                        if (*try_suffix == 0 || *try_suffix == '.')
-                                break;
+        /* If not found, set default as "application/octet-stream";  */
+        found_mime_type = "application/octet-stream";
+        if (suffix) {
+#if ENABLE_FEATURE_HTTPD_CONFIG_WITH_MIME_TYPES
+                Htaccess *cur;
+#endif
+                for (table = suffixTable; *table; table += 2) {
+                        try_suffix = strstr(table[0], suffix);
+                        if (try_suffix) {
+                                try_suffix += strlen(suffix);
+                                if (*try_suffix == '\0' || *try_suffix == '.') {
+                                        found_mime_type = table[1];
+                                        break;
+                                }
+                        }
                 }
-        /* also, if not found, set default as "application/octet-stream";  */
-        found_mime_type = table[1];
 #if ENABLE_FEATURE_HTTPD_CONFIG_WITH_MIME_TYPES
-        if (suffix) {
-                Htaccess * cur;
                 for (cur = mime_a; cur; cur = cur->next) {
                         if (strcmp(cur->before_colon, suffix) == 0) {
                                 found_mime_type = cur->after_colon;
                                 break;
                         }
                 }
+#endif
         }
-#endif  /* FEATURE_HTTPD_CONFIG_WITH_MIME_TYPES */
 
         if (DEBUG)
                 bb_error_msg("sending file '%s' content-type: %s",
@@ -1426,27 +1394,21 @@ static int checkPermIP(void)
         return !flg_deny_all;
 }
 
-/****************************************************************************
- *
- > $Function: checkPerm()
- *
- * $Description: Check the permission file for access password protected.
- *
- *   If config file isn't present, everything is allowed.
- *   Entries are of the form you can see example from header source
+/*
+ * Check the permission file for access password protected.
  *
- * $Parameters:
- *      (const char *) path  . . . . The file path.
- *      (const char *) request . . . User information to validate.
+ * If config file isn't present, everything is allowed.
+ * Entries are of the form you can see example from header source
  *
- * $Return: (int)  . . . . . . . . . 1 if request OK, 0 otherwise.
+ * path      The file path.
+ * request   User information to validate.
  *
- ****************************************************************************/
-
+ * Returns 1 if request is OK.
+ */
 #if ENABLE_FEATURE_HTTPD_BASIC_AUTH
 static int checkPerm(const char *path, const char *request)
 {
-        Htaccess * cur;
+        Htaccess *cur;
         const char *p;
         const char *p0;
 
@@ -1481,7 +1443,7 @@ static int checkPerm(const char *path, const char *request)
                                 char *cipher;
                                 char *pp;
 
-                                if (strncmp(p, request, u-request) != 0) {
+                                if (strncmp(p, request, u - request) != 0) {
                                         /* user uncompared */
                                         continue;
                                 }
@@ -1528,15 +1490,17 @@ static void exit_on_signal(int sig)
 static void handle_incoming_and_exit(void) ATTRIBUTE_NORETURN;
 static void handle_incoming_and_exit(void)
 {
+        static const char request_GET[] ALIGN1 = "GET";
+
         char *url;
         char *purl;
         int count;
-        int blank = -1;
+        int http_major_version;
         char *test;
         struct stat sb;
         int ip_allowed;
 #if ENABLE_FEATURE_HTTPD_CGI
-        const char *prequest = request_GET;
+        const char *prequest;
         unsigned long length = 0;
         char *cookie = 0;
         char *content_type = 0;
@@ -1546,21 +1510,24 @@ static void handle_incoming_and_exit(void)
         int credentials = -1;  /* if not required this is Ok */
 #endif
 
+        /* Install timeout handler */
         sa.sa_handler = exit_on_signal;
         sigemptyset(&sa.sa_mask);
         sa.sa_flags = 0; /* no SA_RESTART */
         sigaction(SIGALRM, &sa, NULL);
+        alarm(HEADER_READ_TIMEOUT);
 
-        alarm(TIMEOUT);
         if (!get_line())
                 _exit(0);  /* EOF or error or empty line */
 
+        /* Determine type of request (GET/POST) */
         purl = strpbrk(iobuf, " \t");
         if (purl == NULL) {
                 send_headers_and_exit(HTTP_BAD_REQUEST);
         }
         *purl = '\0';
 #if ENABLE_FEATURE_HTTPD_CGI
+        prequest = request_GET;
         if (strcasecmp(iobuf, prequest) != 0) {
                 prequest = "POST";
                 if (strcasecmp(iobuf, prequest) != 0) {
@@ -1573,8 +1540,10 @@ static void handle_incoming_and_exit(void)
         }
 #endif
         *purl = ' ';
-        count = sscanf(purl, " %[^ ] HTTP/%d.%*d", iobuf, &blank);
 
+        /* Copy URL from after "GET "/"POST " to stack-allocated char[] */
+        http_major_version = -1;
+        count = sscanf(purl, " %[^ ] HTTP/%d.%*d", iobuf, &http_major_version);
         if (count < 1 || iobuf[0] != '/') {
                 /* Garbled request/URL */
                 send_headers_and_exit(HTTP_BAD_REQUEST);
@@ -1584,7 +1553,8 @@ static void handle_incoming_and_exit(void)
                 send_headers_and_exit(HTTP_INTERNAL_SERVER_ERROR);
         }
         strcpy(url, iobuf);
-        /* extract url args if present */
+
+        /* Extract url args if present */
         test = strchr(url, '?');
         g_query = NULL;
         if (test) {
@@ -1592,6 +1562,7 @@ static void handle_incoming_and_exit(void)
                 g_query = test;
         }
 
+        /* Decode URL escape sequences */
         test = decodeString(url, 0);
         if (test == NULL)
                 send_headers_and_exit(HTTP_BAD_REQUEST);
@@ -1600,7 +1571,8 @@ static void handle_incoming_and_exit(void)
                 send_headers_and_exit(HTTP_NOT_FOUND);
         }
 
-        /* algorithm stolen from libbb bb_simplify_path(),
+        /* Canonicalize path */
+        /* Algorithm stolen from libbb bb_simplify_path(),
          * but don't strdup and reducing trailing slash and protect out root */
         purl = test = url;
         do {
@@ -1631,13 +1603,14 @@ static void handle_incoming_and_exit(void)
         *++purl = '\0';       /* so keep last character */
         test = purl;          /* end ptr */
 
-        /* If URL is directory, adding '/' */
+        /* If URL is a directory, add '/' */
         if (test[-1] != '/') {
                 if (is_directory(url + 1, 1, &sb)) {
                         found_moved_temporarily = url;
                 }
         }
 
+        /* Log it */
         if (verbose > 1)
                 bb_error_msg("url:%s", url);
 
@@ -1653,15 +1626,17 @@ static void handle_incoming_and_exit(void)
                 }
                 *test = '/';
         }
-        if (blank >= 0) {
-                /* read until blank line for HTTP version specified, else parse immediate */
+        if (http_major_version >= 0) {
+                /* Request was with "... HTTP/n.m", and n >= 0 */
+
+                /* Read until blank line for HTTP version specified, else parse immediate */
                 while (1) {
-                        alarm(TIMEOUT);
+                        alarm(HEADER_READ_TIMEOUT);
                         if (!get_line())
                                 break; /* EOF or error or empty line */
-
                         if (DEBUG)
                                 bb_error_msg("header: '%s'", iobuf);
+
 #if ENABLE_FEATURE_HTTPD_CGI
                         /* try and do our best to parse more lines */
                         if ((STRNCASECMP(iobuf, "Content-length:") == 0)) {
@@ -1707,6 +1682,7 @@ static void handle_incoming_and_exit(void)
                 } /* while extra header reading */
         }
 
+        /* We read everything, disable peer timeout */
         alarm(0);
 
         if (strcmp(bb_basename(url), httpd_conf) == 0 || ip_allowed == 0) {
@@ -1727,9 +1703,9 @@ static void handle_incoming_and_exit(void)
         test = url + 1;      /* skip first '/' */
 
 #if ENABLE_FEATURE_HTTPD_CGI
-        if (strncmp(test, "cgi-bin", 7) == 0) {
-                if (test[7] == '/' && test[8] == '\0') {
-                        /* protect listing cgi-bin/ */
+        if (strncmp(test, "cgi-bin/", 8) == 0) {
+                if (test[8] == '\0') {
+                        /* protect listing "cgi-bin/" */
                         send_headers_and_exit(HTTP_FORBIDDEN);
                 }
                 send_cgi_and_exit(url, prequest, length, cookie, content_type);
@@ -1768,7 +1744,11 @@ static void handle_incoming_and_exit(void)
                         send_cgi_and_exit("/cgi-bin/index.cgi", prequest, length, cookie, content_type);
                 }
         }
-#endif  /* FEATURE_HTTPD_CGI */
+#endif
+        /* else {
+         *      fall through to send_file, it errors out if open fails
+         * }
+         */
 
         send_file_and_exit(test);
 
@@ -1813,6 +1793,11 @@ static void handle_incoming_and_exit(void)
 static void mini_httpd(int server) ATTRIBUTE_NORETURN;
 static void mini_httpd(int server)
 {
+        /* NB: it's best to not use xfuncs in this loop before fork().
+         * Otherwise server may die on transient errors (temporary
+         * out-of-memory condition, etc), which is Bad(tm).
+         * Try to do any dangerous calls after fork.
+         */
         while (1) {
                 int n;
                 len_and_sockaddr fromAddr;
@@ -1825,18 +1810,6 @@ static void mini_httpd(int server)
                         continue;
                 /* set the KEEPALIVE option to cull dead connections */
                 setsockopt(n, SOL_SOCKET, SO_KEEPALIVE, &const_int_1, sizeof(const_int_1));
-                accepted_socket = n;
-
-                n = get_nport(&fromAddr.sa);
-                tcp_port = ntohs(n);
-                rmt_ip = 0;
-                if (fromAddr.sa.sa_family == AF_INET) {
-                        rmt_ip = ntohl(fromAddr.sin.sin_addr.s_addr);
-                }
-                if (ENABLE_FEATURE_HTTPD_CGI || DEBUG || verbose) {
-                        free(rmt_ip_str);
-                        rmt_ip_str = xmalloc_sockaddr2dotted(&fromAddr.sa, fromAddr.len);
-                }
 
                 if (fork() == 0) {
                         /* child */
@@ -1844,6 +1817,16 @@ static void mini_httpd(int server)
                         /* Do not reload config on HUP */
                         signal(SIGHUP, SIG_IGN);
 #endif
+                        accepted_socket = n;
+                        n = get_nport(&fromAddr.sa);
+                        tcp_port = ntohs(n);
+                        rmt_ip = 0;
+                        if (fromAddr.sa.sa_family == AF_INET) {
+                                rmt_ip = ntohl(fromAddr.sin.sin_addr.s_addr);
+                        }
+                        if (ENABLE_FEATURE_HTTPD_CGI || DEBUG || verbose) {
+                                rmt_ip_str = xmalloc_sockaddr2dotted(&fromAddr.sa, fromAddr.len);
+                        }
                         if (verbose) {
                                 /* this trick makes -v logging much simpler */
                                 applet_name = rmt_ip_str;
@@ -1853,7 +1836,7 @@ static void mini_httpd(int server)
                         handle_incoming_and_exit();
                 }
                 /* parent, or fork failed */
-                close(accepted_socket);
+                close(n);
         } /* while (1) */
         /* never reached */
 }
@@ -1883,12 +1866,13 @@ static void mini_httpd_inetd(void)
 #if ENABLE_FEATURE_HTTPD_RELOAD_CONFIG_SIGHUP
 static void sighup_handler(int sig)
 {
-        /* set and reset */
         struct sigaction sa;
 
         parse_conf(default_path_httpd_conf, sig == SIGHUP ? SIGNALED_PARSE : FIRST_PARSE);
+
+        memset(&sa, 0, sizeof(sa));
         sa.sa_handler = sighup_handler;
-        sigemptyset(&sa.sa_mask);
+        /*sigemptyset(&sa.sa_mask); - memset should be enough */
         sa.sa_flags = SA_RESTART;
         sigaction(SIGHUP, &sa, NULL);
 }
@@ -1930,12 +1914,13 @@ int httpd_main(int argc, char **argv)
         USE_FEATURE_HTTPD_SETUID(struct bb_uidgid_t ugid;)
         USE_FEATURE_HTTPD_AUTH_MD5(const char *pass;)
 
+        INIT_G();
+
 #if ENABLE_LOCALE_SUPPORT
         /* Undo busybox.c: we want to speak English in http (dates etc) */
         setlocale(LC_TIME, "C");
 #endif
 
-        INIT_G();
         home_httpd = xrealloc_getcwd_or_warn(NULL);
         opt_complementary = "vv"; /* counter */
         /* We do not "absolutize" path given by -h (home) opt.
@@ -2012,13 +1997,12 @@ int httpd_main(int argc, char **argv)
         }
 #endif
 
+#if BB_MMU
 #if ENABLE_FEATURE_HTTPD_RELOAD_CONFIG_SIGHUP
         sighup_handler(0);
 #else
         parse_conf(default_path_httpd_conf, FIRST_PARSE);
 #endif
-
-#if BB_MMU
         if (opt & OPT_INETD)
                 mini_httpd_inetd();
         if (!(opt & OPT_FOREGROUND))