Compare commits

...

2 Commits

Author SHA1 Message Date
Alexey Sheplyakov
a300f01d08 20211007-alt1
- HTTP boot improvements (closes: #41072)
2021-10-07 16:46:06 +04:00
Alexey Sheplyakov
24db85c5ab http: fixed Content-Length header validation
Content-Length is not necesserily the last header, more headers
can follow it.

Closes: #41072
2021-10-07 16:43:36 +04:00
3 changed files with 12 additions and 2 deletions

View File

@ -3,7 +3,7 @@
%def_with splash
Name: propagator
Version: 20210922
Version: 20211007
Release: alt1
Summary: 'Early userspace' set of binaries
@ -48,6 +48,9 @@ including init and various helpers for hw probing and bootstrapping.
%_sbindir/propagator
%changelog
* Thu Oct 07 2021 Alexey Sheplyakov <asheplyakov@altlinux.org> 20211007-alt1
- Fixed HTTP boot when server sent more headers after Content-Length (closes: #41072)
* Thu Sep 22 2021 Alexey Sheplyakov <asheplyakov@altlinux.org> 20210922-alt1
- Support booting complete ISOs via HTTP (closes: #40710)

View File

@ -52,6 +52,11 @@ int main(int argc, char **argv) {
"Content-Length: 1234 ",
"Content-Length: 1234 ",
"Content-Length: 1234 \r\n\r\n",
"Content-Length: 1234\r\n"
"Last-Modified: Sun, 12 Sep 2021 22:31:46 GMT\r\n"
"Connection: close\r\n"
"Etag: \"613e7fd2-3849a800\"\r\n"
"Accept-Ranges: bytes\r\n\r\n"
};
for (i = 0; i < ARRAY_SIZE(invalid_inputs); i++) {

4
url.c
View File

@ -398,6 +398,7 @@ int ftp_end_data_command(int sock)
static int parse_content_length(const char *headers, unsigned long *size) {
const char *header_content_length = "Content-Length: ";
const char *hdr = NULL, *ptr = NULL, *start = NULL, *end = NULL;
const char *nexthdr = NULL;
hdr = strstr(headers, header_content_length);
if (!hdr) {
@ -406,6 +407,7 @@ static int parse_content_length(const char *headers, unsigned long *size) {
}
start = hdr + strlen(header_content_length);
nexthdr = strstr(start, "\r\n");
errno = 0;
*size = strtoul(start, (char **)&end, 10);
@ -432,7 +434,7 @@ static int parse_content_length(const char *headers, unsigned long *size) {
* Note: endptr points first non-digit/space character or
* end of the string
*/
for (ptr = end; *ptr; ptr++) {
for (ptr = end; nexthdr ? ptr < nexthdr : *ptr != '\0'; ptr++) {
if (!isspace(*ptr) && !isdigit(*ptr)) {
log_message("%s: error: invalid character %c in Content-Length header '%s'", __func__, *ptr, hdr);
return -1;