httpd-cvs mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From s.@apache.org
Subject svn commit: r1426992 - /httpd/httpd/trunk/server/protocol.c
Date Sun, 30 Dec 2012 21:24:55 GMT
Author: sf
Date: Sun Dec 30 21:24:55 2012
New Revision: 1426992

URL: http://svn.apache.org/viewvc?rev=1426992&view=rev
Log:
change protocol number parsing in strict mode according to HTTPbis draft

- only accept single digit version components
- don't accept white-space after protocol specification

Modified:
    httpd/httpd/trunk/server/protocol.c

Modified: httpd/httpd/trunk/server/protocol.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/server/protocol.c?rev=1426992&r1=1426991&r2=1426992&view=diff
==============================================================================
--- httpd/httpd/trunk/server/protocol.c (original)
+++ httpd/httpd/trunk/server/protocol.c Sun Dec 30 21:24:55 2012
@@ -672,40 +672,17 @@ static int read_request_line(request_rec
         r->proto_num = HTTP_VERSION(pro[5] - '0', pro[7] - '0');
     }
     else {
-        int nmatch, pos;
-        nmatch = sscanf(r->protocol, "%4s/%u.%u%n", http, &major, &minor, &pos);
         if (strict) {
-            /*
-             * According to the GNU sscanf man page, there are implementations
-             * that increment the number of matches for %n. Therefore we check
-             * nmatch with "<" instead of "!=".
-             */
-            if (nmatch < 3 || (strcmp("HTTP", http) != 0)
-                || (minor >= HTTP_VERSION(1, 0)) ) { /* don't allow HTTP/0.1000 */
-                ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(02418)
-                              "Invalid protocol: %s", r->protocol);
-                if (enforce_strict) {
-                    r->status = HTTP_NOT_IMPLEMENTED;
-                    return 0;
-                }
-            }
-            if (r->protocol[pos] != '\0') {
-                while (r->protocol[pos] == ' ')
-                    pos++;
-                if (r->protocol[pos] != '\0') {
-                    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(02419)
-                                  "Garbage after request line: ... %s",
-                                  r->protocol);
-                    if (enforce_strict) {
-                        r->status = HTTP_BAD_REQUEST;
-                        return 0;
-                    }
-                }
+            ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(02418)
+                          "Invalid protocol '%s'", r->protocol);
+            if (enforce_strict) {
+                r->status = HTTP_BAD_REQUEST;
+                return 0;
             }
-            r->proto_num = HTTP_VERSION(major, minor);
         }
-        else if (nmatch >= 3 && (strcasecmp("http", http) == 0)
-                 && (minor < HTTP_VERSION(1, 0)) ) { /* don't allow HTTP/0.1000
*/
+        if (3 == sscanf(r->protocol, "%4s/%u.%u", http, &major, &minor)
+            && (strcasecmp("http", http) == 0)
+            && (minor < HTTP_VERSION(1, 0)) ) { /* don't allow HTTP/0.1000 */
             r->proto_num = HTTP_VERSION(major, minor);
         }
         else {



Mime
View raw message