generic-library/libupnp
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Avoid access violation after parser_parse_chunky_headers call.

Browse Source 
In parser_parse_chunky_headers, parser->msg.msg.buf can be changed
by membuffer_delete call. Therefore if we save the pointer to
parser->msg.entity.buf before calling membuffer_delete, it will
induce access to released memory.
This commit is contained in:
Yoichi NAKAYAMA 2012-04-12 01:47:26 +09:00
parent e02753736a
commit d72bb5cff5
2 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ChangeLog
View File

@ -2,6 +2,15 @@
Version 1.6.18 Version 1.6.18
******************************************************************************* *******************************************************************************
2012-04-11 Yoichi NAKAYAMA <yoichi.nakayama(at)gmail.com>
Avoid access violation after parser_parse_chunky_headers call.
In parser_parse_chunky_headers, parser->msg.msg.buf can be changed
by membuffer_delete call. Therefore if we save the pointer to
parser->msg.entity.buf before calling membuffer_delete, it will
induce access to released memory.
2012-04-06 Yoichi NAKAYAMA <yoichi.nakayama(at)gmail.com> 2012-04-06 Yoichi NAKAYAMA <yoichi.nakayama(at)gmail.com>
Remove possibility of access violation. Remove possibility of access violation.

8
upnp/src/genlib/net/http/httpparser.c
View File

@ -1682,14 +1682,14 @@ parser_parse_chunky_headers( INOUT http_parser_t * parser )
/* finally, done with the whole msg */ /* finally, done with the whole msg */
parser->position = POS_COMPLETE; parser->position = POS_COMPLETE;
/* save entity start ptr as the very last thing to do */
parser->msg.entity.buf = parser->msg.msg.buf +
parser->entity_start_position;
membuffer_delete( &parser->msg.msg, save_pos, membuffer_delete( &parser->msg.msg, save_pos,
( parser->scanner.cursor - save_pos ) ); ( parser->scanner.cursor - save_pos ) );
parser->scanner.cursor = save_pos; parser->scanner.cursor = save_pos;
/* save entity start ptr as the very last thing to do */
parser->msg.entity.buf = parser->msg.msg.buf +
parser->entity_start_position;
return PARSE_SUCCESS; return PARSE_SUCCESS;
} else { } else {
return status; return status;