Mirrors/libwebsockets
1
0
Fork 0
mirror of https://github.com/warmcat/libwebsockets.git synced 2025-03-16 00:00:07 +01:00
Code Issues Releases Wiki Activity

fuzzer handle junk after upgrade header

Browse source 
Signed-off-by: Andy Green <andy.green@linaro.org>
This commit is contained in:
Andy Green 2016-01-21 11:10:26 +08:00
parent 1587c5537d
commit c29af6641d
1 changed files with 38 additions and 27 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

43
lib/server.c
View file

@ -347,6 +347,9 @@ int lws_handshake_server(struct lws *wsi, unsigned char **buf, size_t len)
/* LWSCM_WS_SERVING */ /* LWSCM_WS_SERVING */
while (len--) { while (len--) {
assert(wsi->mode == LWSCM_HTTP_SERVING);
if (lws_parse(wsi, *(*buf)++)) { if (lws_parse(wsi, *(*buf)++)) {
lwsl_info("lws_parse failed\n"); lwsl_info("lws_parse failed\n");
goto bail_nuke_ah; goto bail_nuke_ah;
@ -362,9 +365,27 @@ int lws_handshake_server(struct lws *wsi, unsigned char **buf, size_t len)
/* is this websocket protocol or normal http 1.0? */ /* is this websocket protocol or normal http 1.0? */
if (!lws_hdr_total_length(wsi, WSI_TOKEN_UPGRADE) || if (lws_hdr_total_length(wsi, WSI_TOKEN_UPGRADE)) {
!lws_hdr_total_length(wsi, WSI_TOKEN_CONNECTION)) { if (!strcasecmp(lws_hdr_simple_ptr(wsi, WSI_TOKEN_UPGRADE),
"websocket")) {
lwsl_info("Upgrade to ws\n");
goto upgrade_ws;
}
#ifdef LWS_USE_HTTP2
if (!strcasecmp(lws_hdr_simple_ptr(wsi, WSI_TOKEN_UPGRADE),
"h2c-14")) {
lwsl_info("Upgrade to h2c-14\n");
goto upgrade_h2c;
}
#endif
lwsl_err("Unknown upgrade\n");
/* dunno what he wanted to upgrade to */
goto bail_nuke_ah;
}
/* no upgrade ack... he remained as HTTP */
lwsl_info("No upgrade\n");
ah = wsi->u.hdr.ah; ah = wsi->u.hdr.ah;
lws_union_transition(wsi, LWSCM_HTTP_SERVING_ACCEPTED); lws_union_transition(wsi, LWSCM_HTTP_SERVING_ACCEPTED);
@ -373,22 +394,11 @@ int lws_handshake_server(struct lws *wsi, unsigned char **buf, size_t len)
/* expose it at the same offset as u.hdr */ /* expose it at the same offset as u.hdr */
wsi->u.http.ah = ah; wsi->u.http.ah = ah;
lwsl_debug("%s: wsi %p: ah %p\n", __func__, (void *)wsi, (void *)wsi->u.hdr.ah);
n = lws_http_action(wsi); n = lws_http_action(wsi);
return n; return n;
}
if (!strcasecmp(lws_hdr_simple_ptr(wsi, WSI_TOKEN_UPGRADE),
"websocket"))
goto upgrade_ws;
#ifdef LWS_USE_HTTP2
if (!strcasecmp(lws_hdr_simple_ptr(wsi, WSI_TOKEN_UPGRADE),
"h2c-14"))
goto upgrade_h2c;
#endif
/* dunno what he wanted to upgrade to */
goto bail_nuke_ah;
#ifdef LWS_USE_HTTP2 #ifdef LWS_USE_HTTP2
upgrade_h2c: upgrade_h2c:
@ -578,8 +588,9 @@ upgrade_ws:
return 1; return 1;
} }
#endif #endif
lwsl_parser("accepted v%02d connection\n", lwsl_parser("accepted v%02d connection\n", wsi->ietf_spec_revision);
wsi->ietf_spec_revision);
return 0;
} /* while all chars are handled */ } /* while all chars are handled */
return 0; return 0;