httpd: More robust Content-length: parsing,

code reorganization (less indented)


git-svn-id: svn://busybox.net/trunk/busybox@16593 69ca8d6d-28ef-0310-b511-8ec308f3f277

1 files changed, 86 insertions, 84 deletions

diff --git a/networking/httpd.c b/networking/httpd.c
index d5cfd652c..71792862e 100644
--- a/networking/httpd.c
+++ b/networking/httpd.c
@@ -256,7 +256,9 @@ static const HttpEnumString httpResponseNames[] = {
 
 
 static const char RFC1123FMT[] = "%a, %d %b %Y %H:%M:%S GMT";
-static const char Content_length[] = "Content-length:";
+
+
+#define STRNCASECMP(a, str) strncasecmp((a), (str), sizeof(str)-1)
 
 
 static int scan_ip(const char **ep, unsigned int *ip, unsigned char endc)
@@ -880,7 +882,7 @@ static int sendHeaders(HttpResponseNum responseNum)
         if (config->ContentLength != -1) {    /* file */
                 strftime(timeStr, sizeof(timeStr), RFC1123FMT, gmtime(&config->last_mod));
                 len += sprintf(buf+len, "Last-Modified: %s\r\n%s %"OFF_FMT"\r\n",
-                                timeStr, Content_length, (off_t) config->ContentLength);
+                                timeStr, "Content-length:", (off_t) config->ContentLength);
         }
         strcat(buf, "\r\n");
         len += 2;
@@ -962,20 +964,15 @@ static int sendCgi(const char *url,
         int outFd;
         int firstLine = 1;
 
-        do {
-                if (pipe(fromCgi) != 0) {
-                        break;
-                }
-                if (pipe(toCgi) != 0) {
-                        break;
-                }
-
-                pid = fork();
-                if (pid < 0) {
-                        pid = 0;
-                        break;
-                }
+        if (pipe(fromCgi) != 0)
+                return 0;
+        if (pipe(toCgi) != 0)
+                return 0;
+        pid = fork();
+        if (pid < 0)
+                return 0;
 
+        do {    
                 if (!pid) {
                         /* child process */
                         char *script;
@@ -1031,10 +1028,9 @@ static int sendCgi(const char *url,
                         if (script != NULL)
                                 *script = '\0';         /* reduce /PATH_INFO */
                          /* SCRIPT_FILENAME required by PHP in CGI mode */
-                        if (realpath(purl + 1, realpath_buff))
-                                setenv1("SCRIPT_FILENAME", realpath_buff);
-                        else
-                                *realpath_buff = '\0';
+                        if (!realpath(purl + 1, realpath_buff))
+                                goto error_execing_cgi;
+                        setenv1("SCRIPT_FILENAME", realpath_buff);
                         /* set SCRIPT_NAME as full path: /cgi-bin/dirs/script.cgi */
                         setenv1("SCRIPT_NAME", purl);
                         setenv1("QUERY_STRING", config->query);
@@ -1045,9 +1041,8 @@ static int sendCgi(const char *url,
 #if ENABLE_FEATURE_HTTPD_SET_REMOTE_PORT_TO_ENV
                         setenv_long("REMOTE_PORT", config->port);
 #endif
-                        if (bodyLen) {
+                        if (bodyLen)
                                 setenv_long("CONTENT_LENGTH", bodyLen);
-                        }
                         if (cookie)
                                 setenv1("HTTP_COOKIE", cookie);
                         if (content_type)
@@ -1064,37 +1059,37 @@ static int sendCgi(const char *url,
                         /* set execve argp[0] without path */
                         argp[0] = strrchr(purl, '/') + 1;
                         /* but script argp[0] must have absolute path and chdiring to this */
-                        if (*realpath_buff) {
-                                script = strrchr(realpath_buff, '/');
-                                if (script) {
-                                        *script = '\0';
-                                        if (chdir(realpath_buff) == 0) {
-                                                // now run the program.  If it fails,
-                                                // use _exit() so no destructors
-                                                // get called and make a mess.
+                        script = strrchr(realpath_buff, '/');
+                        if (!script)
+                                goto error_execing_cgi;
+                        *script = '\0';
+                        if (chdir(realpath_buff) == 0) {
+                                // now run the program.  If it fails,
+                                // use _exit() so no destructors
+                                // get called and make a mess.
 #if ENABLE_FEATURE_HTTPD_CONFIG_WITH_SCRIPT_INTERPR
-                                                char *interpr = NULL;
-                                                char *suffix = strrchr(purl, '.');
-
-                                                if (suffix) {
-                                                        Htaccess * cur;
-                                                        for (cur = config->script_i; cur; cur = cur->next)
-                                                                if (strcmp(cur->before_colon + 1, suffix) == 0) {
-                                                                        interpr = cur->after_colon;
-                                                                        break;
-                                                                }
+                                char *interpr = NULL;
+                                char *suffix = strrchr(purl, '.');
+
+                                if (suffix) {
+                                        Htaccess *cur;
+                                        for (cur = config->script_i; cur; cur = cur->next) {
+                                                if (strcmp(cur->before_colon + 1, suffix) == 0) {
+                                                        interpr = cur->after_colon;
+                                                        break;
                                                 }
+                                        }
+                                }
 #endif
-                                                *script = '/';
+                                *script = '/';
 #if ENABLE_FEATURE_HTTPD_CONFIG_WITH_SCRIPT_INTERPR
-                                                if (interpr)
-                                                        execv(interpr, argp);
-                                                else
+                                if (interpr)
+                                        execv(interpr, argp);
+                                else
 #endif
-                                                        execv(realpath_buff, argp);
-                                        }
-                                }
+                                        execv(realpath_buff, argp);
                         }
+ error_execing_cgi:
                         /* send to stdout (even if we are not from inetd) */
                         config->accepted_socket = 1;
                         sendHeaders(HTTP_NOT_FOUND);
@@ -1103,7 +1098,7 @@ static int sendCgi(const char *url,
 
         } while (0);
 
-        if (pid) {
+        if (pid > 0) {
                 /* parent process */
                 int status;
                 size_t post_readed_size = 0, post_readed_idx = 0;
@@ -1425,7 +1420,7 @@ static void handleIncoming(void)
         int ip_allowed;
 #if ENABLE_FEATURE_HTTPD_CGI
         const char *prequest = request_GET;
-        long length = 0;
+        unsigned long length = 0;
         char *cookie = 0;
         char *content_type = 0;
 #endif
@@ -1452,11 +1447,11 @@ static void handleIncoming(void)
 
                 purl = strpbrk(buf, " \t");
                 if (purl == NULL) {
-BAD_REQUEST:
+ BAD_REQUEST:
                         sendHeaders(HTTP_BAD_REQUEST);
                         break;
                 }
-                *purl = 0;
+                *purl = '\0';
 #if ENABLE_FEATURE_HTTPD_CGI
                 if (strcasecmp(buf, prequest) != 0) {
                         prequest = "POST";
@@ -1487,29 +1482,35 @@ BAD_REQUEST:
                 /* extract url args if present */
                 test = strchr(url, '?');
                 if (test) {
-                        *test++ = 0;
+                        *test++ = '\0';
                         config->query = test;
                 }
 
                 test = decodeString(url, 0);
                 if (test == NULL)
                         goto BAD_REQUEST;
+                /* FIXME: bug? should be "url+1"? */
                 if (test == (buf+1)) {
                         sendHeaders(HTTP_NOT_FOUND);
                         break;
                 }
+
                 /* algorithm stolen from libbb bb_simplify_path(),
                          but don't strdup and reducing trailing slash and protect out root */
                 purl = test = url;
-
                 do {
                         if (*purl == '/') {
-                                if (*test == '/') {        /* skip duplicate (or initial) slash */
+                                /* skip duplicate (or initial) slash */
+                                if (*test == '/') {
                                         continue;
-                                } else if (*test == '.') {
-                                        if (test[1] == '/' || test[1] == 0) { /* skip extra '.' */
+                                }
+                                if (*test == '.') {
+                                        /* skip extra '.' */
+                                        if (test[1] == '/' || test[1] == 0) {
                                                 continue;
-                                        } else if ((test[1] == '.') && (test[2] == '/' || test[2] == 0)) {
+                                        } else
+                                        /* '..': be careful */
+                                        if (test[1] == '.' && (test[2] == '/' || test[2] == 0)) {
                                                 ++test;
                                                 if (purl == url) {
                                                         /* protect out root */
@@ -1522,9 +1523,8 @@ BAD_REQUEST:
                         }
                         *++purl = *test;
                 } while (*++test);
-
-                *++purl = 0;        /* so keep last character */
-                test = purl;        /* end ptr */
+                *++purl = '\0';       /* so keep last character */
+                test = purl;          /* end ptr */
 
                 /* If URL is directory, adding '/' */
                 if (test[-1] != '/') {
@@ -1560,36 +1560,40 @@ BAD_REQUEST:
 
 #if ENABLE_FEATURE_HTTPD_CGI
                                 /* try and do our best to parse more lines */
-                                if ((strncasecmp(buf, Content_length, 15) == 0)) {
-                                        if (prequest != request_GET)
-                                                length = strtol(buf + 15, 0, 0); // extra read only for POST
-                                } else if ((strncasecmp(buf, "Cookie:", 7) == 0)) {
-                                        for (test = buf + 7; isspace(*test); test++)
-                                                  ;
-                                        cookie = strdup(test);
-                                } else if ((strncasecmp(buf, "Content-Type:", 13) == 0)) {
-                                        for (test = buf + 13; isspace(*test); test++)
-                                                  ;
-                                        content_type = strdup(test);
-                                } else if ((strncasecmp(buf, "Referer:", 8) == 0)) {
-                                        for (test = buf + 8; isspace(*test); test++)
-                                                  ;
-                                        config->referer = strdup(test);
+                                if ((STRNCASECMP(buf, "Content-length:") == 0)) {
+                                        /* extra read only for POST */
+                                        if (prequest != request_GET) {
+                                                test = buf + sizeof("Content-length:")-1;
+                                                if (!test[0]) goto bail_out;
+                                                errno = 0;
+                                                /* not using strtoul: it ignores leading munis! */
+                                                length = strtol(test, &test, 10);
+                                                /* length is "ulong", but we need to pass it to int later */
+                                                /* so we check for negative or too large values in one go: */
+                                                /* (long -> ulong conv will cause negatives to be seen as > INT_MAX) */
+                                                if (test[0] || errno || length > INT_MAX)
+                                                        goto bail_out;
+                                        }
+                                } else if ((STRNCASECMP(buf, "Cookie:") == 0)) {
+                                        cookie = strdup(skip_whitespace(buf + sizeof("Cookie:")-1));
+                                } else if ((STRNCASECMP(buf, "Content-Type:") == 0)) {
+                                        content_type = strdup(skip_whitespace(buf + sizeof("Content-Type:")-1));
+                                } else if ((STRNCASECMP(buf, "Referer:") == 0)) {
+                                        config->referer = strdup(skip_whitespace(buf + sizeof("Referer:")-1));
                                 }
 #endif
 
 #if ENABLE_FEATURE_HTTPD_BASIC_AUTH
-                                if (strncasecmp(buf, "Authorization:", 14) == 0) {
+                                if (STRNCASECMP(buf, "Authorization:") == 0) {
                                         /* We only allow Basic credentials.
                                          * It shows up as "Authorization: Basic <userid:password>" where
                                          * the userid:password is base64 encoded.
                                          */
-                                        for (test = buf + 14; isspace(*test); test++)
-                                                ;
-                                        if (strncasecmp(test, "Basic", 5) != 0)
+                                        test = skip_whitespace(buf + sizeof("Authorization:")-1);
+                                        if (STRNCASECMP(test, "Basic") != 0)
                                                 continue;
-
-                                        test += 5;  /* decodeBase64() skiping space self */
+                                        test += sizeof("Basic")-1;
+                                        /* decodeBase64() skips whitespace itself */
                                         decodeBase64(test);
                                         credentials = checkPerm(url, test);
                                 }
@@ -1627,10 +1631,6 @@ FORBIDDEN:		/* protect listing /cgi-bin */
                 test = url + 1;      /* skip first '/' */
 
 #if ENABLE_FEATURE_HTTPD_CGI
-                /* if strange Content-Length */
-                if (length < 0)
-                        break;
-
                 if (strncmp(test, "cgi-bin", 7) == 0) {
                         if (test[7] == '/' && test[8] == 0)
                                 goto FORBIDDEN;     // protect listing cgi-bin/
@@ -1654,6 +1654,8 @@ FORBIDDEN:		/* protect listing /cgi-bin */
 #endif
         } while (0);
 
+ bail_out:
+
         if (DEBUG)
                 fprintf(stderr, "closing socket\n\n");
 #if ENABLE_FEATURE_HTTPD_CGI