From a29e606b6f97c00d0b7e80cb0592bca54f92f2c9 Mon Sep 17 00:00:00 2001 From: Dirk Engling Date: Fri, 6 Nov 2026 21:17:54 +0100 Subject: Fix a theoretical bug where a short request packet yields an oob read --- src/ot_http.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'src') diff --git a/src/ot_http.c b/src/ot_http.c index fc49333..1b5281c 100644 --- a/src/ot_http.c +++ b/src/ot_http.c @@ -762,8 +762,8 @@ ssize_t http_handle_request(const int64_t sock, struct ot_workstruct *ws) { } } - /* This one implicitely tests strlen < 5, too -- remember, it is \n terminated */ - if (memcmp(read_ptr, "GET /", 5)) + /* The request need not be NUL terminated and can be shorter than the literal */ + if (ws->request_size < 5 || memcmp(read_ptr, "GET /", 5)) HTTPERROR_400; /* Skip leading '/' */ @@ -786,7 +786,7 @@ ssize_t http_handle_request(const int64_t sock, struct ot_workstruct *ws) { if ((*write_ptr == 'a') || (*write_ptr == '?')) http_handle_announce(sock, ws, read_ptr); #ifdef WANT_FULLSCRAPE - else if (!memcmp(write_ptr, "scrape HTTP/", 12)) + else if (ws->request + ws->request_size - write_ptr >= 12 && !memcmp(write_ptr, "scrape HTTP/", 12)) http_handle_fullscrape(sock, ws); #endif /* This is the hardcore match for scrape */ -- cgit v1.3