Fix a theoretical bug where a short request packet yields an oob read

1 files changed, 3 insertions, 3 deletions

diff --git a/src/ot_http.c b/src/ot_http.c
index fc49333..1b5281c 100644
--- a/src/ot_http.c
+++ b/src/ot_http.c
@@ -762,8 +762,8 @@ ssize_t http_handle_request(const int64_t sock, struct ot_workstruct *ws) {
     }
   }
 
-  /* This one implicitely tests strlen < 5, too -- remember, it is \n terminated */
-  if (memcmp(read_ptr, "GET /", 5))
+  /* The request need not be NUL terminated and can be shorter than the literal */
+  if (ws->request_size < 5 || memcmp(read_ptr, "GET /", 5))
     HTTPERROR_400;
 
   /* Skip leading '/' */
@@ -786,7 +786,7 @@ ssize_t http_handle_request(const int64_t sock, struct ot_workstruct *ws) {
   if ((*write_ptr == 'a') || (*write_ptr == '?'))
     http_handle_announce(sock, ws, read_ptr);
 #ifdef WANT_FULLSCRAPE
-  else if (!memcmp(write_ptr, "scrape HTTP/", 12))
+  else if (ws->request + ws->request_size - write_ptr >= 12 && !memcmp(write_ptr, "scrape HTTP/", 12))
     http_handle_fullscrape(sock, ws);
 #endif
   /* This is the hardcore match for scrape */