Attachment #124941 for bug #185442





	int done = 0;

	data_string *ds = NULL;

	/*
	 * Request: "^(GET|POST|HEAD) ([^ ]+(\\?[^ ]+|)) (HTTP/1\\.[01])$"
	 * Option : "^([-a-zA-Z]+): (.+)$"

			switch(*cur) {
			case '\r':
				if (con->parse_request->ptr[i+1] == '\n') {
					data_string *ds = NULL;

					/* End of Headerline */
					con->parse_request->ptr[i] = '\0';
					con->parse_request->ptr[i+1] = '\0';

					if (in_folding) {
						buffer *key_b;
						/**
						 * we use a evil hack to handle the line-folding
						 * 
						 * As array_insert_unique() deletes 'ds' in the case of a duplicate
						 * ds points somewhere and we get a evil crash. As a solution we keep the old
						 * "key" and get the current value from the hash and append us
						 *
						 * */

						if (!key || !key_len) {
							/* 400 */

							if (srv->srvconf.log_request_header_on_error) {

							con->response.keep_alive = 0;
							return 0;
						}

						key_b = buffer_init();
						buffer_copy_string_len(key_b, key, key_len);

						if (NULL != (ds = (data_string *)array_get_element(con->request.headers, key_b->ptr))) {
							buffer_append_string(ds->value, value);
						}

						buffer_free(key_b);
					} else {
						int s_len;
						key = con->parse_request->ptr + first;

					first = i+1;
					is_key = 1;
					value = 0;
#if 0
					/**
					 * for Bug 1230 keep the key_len a live
					 */
					key_len = 0; 
#endif
					in_folding = 0;
				} else {
					if (srv->srvconf.log_request_header_on_error) {

Lines 8-14 Link Here

(-)tests/core-request.t (-1 / +33 lines)
8		8
9	use strict;	9	use strict;
10	use IO::Socket;	10	use IO::Socket;
11	use Test::More tests => 33;	11	use Test::More tests => 36;
12	use LightyTest;	12	use LightyTest;
13		13
14	my $tf = LightyTest->new();	14	my $tf = LightyTest->new();
Lines 273-278 Link Here
273	$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200 } ];	273	$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200 } ];
274	ok($tf->handle_http($t) == 0, 'uppercase filenames');	274	ok($tf->handle_http($t) == 0, 'uppercase filenames');
275		275
		276	$t->{REQUEST} = ( <<EOF
		277	GET / HTTP/1.0
		278	Location: foo
		279	Location: foobar
		280	baz
		281	EOF
		282	);
		283	$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200 } ];
		284	ok($tf->handle_http($t) == 0, '#1232 - duplicate headers with line-wrapping');
276		285
		286	$t->{REQUEST} = ( <<EOF
		287	GET / HTTP/1.0
		288	Location:
		289	Location: foobar
		290	baz
		291	EOF
		292	);
		293	$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200 } ];
		294	ok($tf->handle_http($t) == 0, '#1232 - duplicate headers with line-wrapping - test 2');
		295
		296	$t->{REQUEST} = ( <<EOF
		297	GET / HTTP/1.0
		298	A:
		299	Location: foobar
		300	baz
		301	EOF
		302	);
		303	$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200 } ];
		304	ok($tf->handle_http($t) == 0, '#1232 - duplicate headers with line-wrapping - test 3');
		305
		306
		307
		308
277	ok($tf->stop_proc == 0, "Stopping lighttpd");	309	ok($tf->stop_proc == 0, "Stopping lighttpd");
278		310

Return to bug 185442

Lines 284-291 Link Here

(-)src/request.c (-5 / +28 lines)
284		284
285	int done = 0;	285	int done = 0;
286		286
287	data_string *ds = NULL;
288
289	/*	287	/*
290	* Request: "^(GET\|POST\|HEAD) ([^ ]+(\\?[^ ]+\|)) (HTTP/1\\.[01])$"	288	* Request: "^(GET\|POST\|HEAD) ([^ ]+(\\?[^ ]+\|)) (HTTP/1\\.[01])$"
291	* Option : "^([-a-zA-Z]+): (.+)$"	289	* Option : "^([-a-zA-Z]+): (.+)$"
Lines 715-726 Link Here
715	switch(*cur) {	713	switch(*cur) {
716	case '\r':	714	case '\r':
717	if (con->parse_request->ptr[i+1] == '\n') {	715	if (con->parse_request->ptr[i+1] == '\n') {
		716	data_string *ds = NULL;
		717
718	/* End of Headerline */	718	/* End of Headerline */
719	con->parse_request->ptr[i] = '\0';	719	con->parse_request->ptr[i] = '\0';
720	con->parse_request->ptr[i+1] = '\0';	720	con->parse_request->ptr[i+1] = '\0';
721		721
722	if (in_folding) {	722	if (in_folding) {
723	if (!ds) {	723	buffer *key_b;
		724	/**
		725	* we use a evil hack to handle the line-folding
		726	*
		727	* As array_insert_unique() deletes 'ds' in the case of a duplicate
		728	* ds points somewhere and we get a evil crash. As a solution we keep the old
		729	* "key" and get the current value from the hash and append us
		730	*
		731	* */
		732
		733	if (!key \|\| !key_len) {
724	/* 400 */	734	/* 400 */
725		735
726	if (srv->srvconf.log_request_header_on_error) {	736	if (srv->srvconf.log_request_header_on_error) {
Lines 737-743 Link Here
737	con->response.keep_alive = 0;	747	con->response.keep_alive = 0;
738	return 0;	748	return 0;
739	}	749	}
740	buffer_append_string(ds->value, value);	750
		751	key_b = buffer_init();
		752	buffer_copy_string_len(key_b, key, key_len);
		753
		754	if (NULL != (ds = (data_string *)array_get_element(con->request.headers, key_b->ptr))) {
		755	buffer_append_string(ds->value, value);
		756	}
		757
		758	buffer_free(key_b);
741	} else {	759	} else {
742	int s_len;	760	int s_len;
743	key = con->parse_request->ptr + first;	761	key = con->parse_request->ptr + first;
Lines 969-975 Link Here
969	first = i+1;	987	first = i+1;
970	is_key = 1;	988	is_key = 1;
971	value = 0;	989	value = 0;
972	key_len = 0;	990	#if 0
		991	/**
		992	* for Bug 1230 keep the key_len a live
		993	*/
		994	key_len = 0;
		995	#endif
973	in_folding = 0;	996	in_folding = 0;
974	} else {	997	} else {
975	if (srv->srvconf.log_request_header_on_error) {	998	if (srv->srvconf.log_request_header_on_error) {