diff --git a/lib/roles/http/header.c b/lib/roles/http/header.c index 5bf3d371d..0a7d92e04 100644 --- a/lib/roles/http/header.c +++ b/lib/roles/http/header.c @@ -338,6 +338,7 @@ lws_return_http_status(struct lws *wsi, unsigned int code, unsigned char *p = pt->serv_buf + LWS_PRE; unsigned char *start = p; unsigned char *end = p + context->pt_serv_buf_size - LWS_PRE; + char *body = (char *)start + context->pt_serv_buf_size - 512; int n = 0, m = 0, len; char slen[20]; @@ -372,9 +373,15 @@ lws_return_http_status(struct lws *wsi, unsigned int code, &p, end)) return 1; - len = 35 + (int)strlen(html_body) + sprintf(slen, "%d", code); - n = sprintf(slen, "%d", len); + len = lws_snprintf(body, 510, "" + "" + "" + "

%u

%s", code, html_body); + + n = sprintf(slen, "%d", len); if (lws_add_http_header_by_token(wsi, WSI_TOKEN_HTTP_CONTENT_LENGTH, (unsigned char *)slen, n, &p, end)) return 1; @@ -384,7 +391,6 @@ lws_return_http_status(struct lws *wsi, unsigned int code, #if defined(LWS_WITH_HTTP2) if (wsi->http2_substream) { - char *body = (char *)start + context->pt_serv_buf_size - 512; /* * for HTTP/2, the headers must be sent separately, since they @@ -407,9 +413,6 @@ lws_return_http_status(struct lws *wsi, unsigned int code, * ... but stash the body and send it as a priority next * handle_POLLOUT */ - - len = sprintf(body, "

%u

%s", - code, html_body); wsi->http.tx_content_length = len; wsi->http.tx_content_remain = len; @@ -429,11 +432,9 @@ lws_return_http_status(struct lws *wsi, unsigned int code, * for http/1, we can just append the body after the finalized * headers and send it all in one go. */ - p += lws_snprintf((char *)p, end - p - 1, - "

%u

%s", - code, html_body); - n = lws_ptr_diff(p, start); + n = lws_ptr_diff(p, start) + len; + memcpy(p, body, len); m = lws_write(wsi, start, n, LWS_WRITE_HTTP); if (m != n) return 1; diff --git a/scripts/attack.sh b/scripts/attack.sh index a6946bbca..3f3a67a54 100755 --- a/scripts/attack.sh +++ b/scripts/attack.sh @@ -45,12 +45,12 @@ function check { fi if [ "$1" = "defaultplusforbidden" ] ; then cat $CORPUS > /tmp/plusforb - echo -e -n "HTTP/1.0 403 Forbidden\x0d\x0acontent-type: text/html\x0d\x0acontent-length: 38\x0d\x0a\x0d\x0a

403

" >> /tmp/plusforb + echo -e -n "HTTP/1.0 403 Forbidden\x0d\x0acontent-type: text/html\x0d\x0acontent-length: 173\x0d\x0a\x0d\x0a

403

" >> /tmp/plusforb diff /tmp/lwscap /tmp/plusforb > /dev/null if [ $? -ne 0 ] ; then cat $CORPUS > /tmp/plusforb - echo -e -n "HTTP/1.1 403 Forbidden\x0d\x0acontent-type: text/html\x0d\x0acontent-length: 38\x0d\x0a\x0d\x0a

403

" >> /tmp/plusforb + echo -e -n "HTTP/1.1 403 Forbidden\x0d\x0acontent-type: text/html\x0d\x0acontent-length: 173\x0d\x0a\x0d\x0a

403

" >> /tmp/plusforb diff /tmp/lwscap /tmp/plusforb > /dev/null if [ $? -ne 0 ] ; then