generic-library/libupnp
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

scanner_get_token: robustness improvement

Browse Source 
Patch to make scanner_get_token more robust (avoid over-reading).
(cherry picked from commit a3c540bc9ba74560239e2a906db4846fcdbec90e)
This commit is contained in:
Peng 2013-08-14 09:22:43 -03:00 committed by Marcelo Roberto Jimenez
parent 4a78847fb9
commit cf8c0d0a93
3 changed files with 5 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
ChangeLog
View File

@ -357,16 +357,9 @@ Version 1.8.0
Version 1.6.19 Version 1.6.19
******************************************************************************* *******************************************************************************
2013-07-30 Robert Buckley <rbuckley(at)users.sf.net> 2013-08-13 Peng <howtofly(at)gmail.com>
SF ticket #53 Action Error Response not returned Patch to make scanner_get_token more robust (avoid over-reading).
In soap_ctrlpt.c, in function get_response_value:
upnp_error_code is checked to see if it is less than 400 because that
would indicate a SOAP error code.
However it should be checked to see if it is greater than 400.
2013-07-30 Zheng Peng <darkelf2010(at)users.sf.net> 2013-07-30 Zheng Peng <darkelf2010(at)users.sf.net>

1
THANKS
View File

@ -54,6 +54,7 @@ exempt of errors.
- Oskar Liljeblad - Oskar Liljeblad
- Michael (oxygenic) - Michael (oxygenic)
- Paul Vixie - Paul Vixie
- Peng
- Peter Hartley - Peter Hartley
- Rene Hexel - Rene Hexel
- Robert Buckley (rbuckley) - Robert Buckley (rbuckley)

4
upnp/src/genlib/net/http/httpparser.c
View File

@ -245,7 +245,7 @@ static parse_status_t scanner_get_token(
/* scan identifier */ /* scan identifier */
token->buf = cursor++; token->buf = cursor++;
token_type = TT_IDENTIFIER; token_type = TT_IDENTIFIER;
while (is_identifier_char(*cursor)) while (cursor < null_terminator && is_identifier_char(*cursor))
cursor++; cursor++;
if (!scanner->entire_msg_loaded && cursor == null_terminator) if (!scanner->entire_msg_loaded && cursor == null_terminator)
/* possibly more valid chars */ /* possibly more valid chars */
@ -255,7 +255,7 @@ static parse_status_t scanner_get_token(
} else if (c == ' ' || c == '\t') { } else if (c == ' ' || c == '\t') {
token->buf = cursor++; token->buf = cursor++;
token_type = TT_WHITESPACE; token_type = TT_WHITESPACE;
while (*cursor == ' ' || *cursor == '\t') while (cursor < null_terminator && (*cursor == ' ' || *cursor == '\t'))
cursor++; cursor++;
if (!scanner->entire_msg_loaded && cursor == null_terminator) if (!scanner->entire_msg_loaded && cursor == null_terminator)
/* possibly more chars */ /* possibly more chars */