@@ -3968,8 +3968,8 @@ UINT temp_realm_length = 0;
39683968 }
39693969
39703970 /* Send response back to HTTP Client. */
3971- _nx_web_http_server_response_send(server_ptr, NX_WEB_HTTP_STATUS_INTERNAL_ERROR ,
3972- sizeof(NX_WEB_HTTP_STATUS_INTERNAL_ERROR ) - 1,
3971+ _nx_web_http_server_response_send(server_ptr, NX_WEB_HTTP_STATUS_BAD_REQUEST ,
3972+ sizeof(NX_WEB_HTTP_STATUS_BAD_REQUEST ) - 1,
39733973 "NetX HTTP Receive Timeout",
39743974 sizeof("NetX HTTP Receive Timeout") - 1, NX_NULL, 0);
39753975
@@ -4215,6 +4215,7 @@ VOID _nx_web_http_server_put_process(NX_WEB_HTTP_SERVER *server_ptr, NX_PACKET
42154215
42164216UINT status;
42174217ULONG length = 0;
4218+ ULONG consumed_length = 0;
42184219UINT offset;
42194220CHAR *name_ptr;
42204221CHAR *password_ptr;
@@ -4447,8 +4448,7 @@ UINT temp_realm_length = 0;
44474448 nx_packet_release(packet_ptr);
44484449 }
44494450
4450- /* Error, return to caller. */
4451- return;
4451+ goto put_process_end;
44524452 }
44534453
44544454 /* Open the specified file for writing. */
@@ -4470,8 +4470,7 @@ UINT temp_realm_length = 0;
44704470 nx_packet_release(packet_ptr);
44714471 }
44724472
4473- /* Error, return to caller. */
4474- return;
4473+ goto put_process_end;
44754474 }
44764475
44774476 /* Determine if there is any content in the first packet. */
@@ -4498,12 +4497,28 @@ UINT temp_realm_length = 0;
44984497 nx_packet_release(packet_ptr);
44994498 }
45004499
4501- /* Error, return to caller. */
4502- return;
4500+ goto put_process_end;
45034501 }
45044502
45054503 /* Update the length. */
4506- length = length - ((ULONG)(packet_ptr -> nx_packet_append_ptr - packet_ptr -> nx_packet_prepend_ptr) - offset);
4504+ consumed_length = ((ULONG)(packet_ptr -> nx_packet_append_ptr - packet_ptr -> nx_packet_prepend_ptr) - offset);
4505+ if ((length - consumed_length) > length)
4506+ {
4507+ /* Underflow error has occurred.*/
4508+
4509+ /* Send response back to HTTP Client. */
4510+ _nx_web_http_server_response_send(server_ptr, NX_WEB_HTTP_STATUS_BAD_REQUEST,
4511+ sizeof(NX_WEB_HTTP_STATUS_BAD_REQUEST) - 1,
4512+ "NetX HTTP Content Length",
4513+ sizeof("NetX HTTP Content Length") - 1, NX_NULL, 0);
4514+
4515+ /* Release the previous data packet. */
4516+ nx_packet_release(data_packet_ptr);
4517+
4518+ status = NX_UNDERFLOW;
4519+ goto put_process_end;
4520+ }
4521+ length -= consumed_length;
45074522
45084523 /* Increment the bytes received count. */
45094524 server_ptr -> nx_web_http_server_total_bytes_received = server_ptr -> nx_web_http_server_total_bytes_received +
@@ -4536,12 +4551,28 @@ UINT temp_realm_length = 0;
45364551 nx_packet_release(packet_ptr);
45374552 }
45384553
4539- /* Error, return to caller. */
4540- return;
4554+ goto put_process_end;
45414555 }
45424556
45434557 /* Update the length. */
4544- length = length - (ULONG)(next_packet_ptr -> nx_packet_append_ptr - next_packet_ptr -> nx_packet_prepend_ptr);
4558+ consumed_length = (ULONG)(next_packet_ptr -> nx_packet_append_ptr - next_packet_ptr -> nx_packet_prepend_ptr);
4559+ if ((length - consumed_length) > length)
4560+ {
4561+ /* Underflow error has occurred.*/
4562+
4563+ /* Send response back to HTTP Client. */
4564+ _nx_web_http_server_response_send(server_ptr, NX_WEB_HTTP_STATUS_BAD_REQUEST,
4565+ sizeof(NX_WEB_HTTP_STATUS_BAD_REQUEST) - 1,
4566+ "NetX HTTP Content Length",
4567+ sizeof("NetX HTTP Content Length") - 1, NX_NULL, 0);
4568+
4569+ /* Release the previous data packet. */
4570+ nx_packet_release(data_packet_ptr);
4571+
4572+ status = NX_UNDERFLOW;
4573+ goto put_process_end;
4574+ }
4575+ length -= consumed_length;
45454576
45464577 /* Increment the bytes received count. */
45474578 server_ptr -> nx_web_http_server_total_bytes_received = server_ptr -> nx_web_http_server_total_bytes_received +
@@ -4575,13 +4606,12 @@ UINT temp_realm_length = 0;
45754606 }
45764607
45774608 /* Send response back to HTTP Client. */
4578- _nx_web_http_server_response_send(server_ptr, NX_WEB_HTTP_STATUS_INTERNAL_ERROR ,
4579- sizeof(NX_WEB_HTTP_STATUS_INTERNAL_ERROR ) - 1,
4609+ _nx_web_http_server_response_send(server_ptr, NX_WEB_HTTP_STATUS_BAD_REQUEST ,
4610+ sizeof(NX_WEB_HTTP_STATUS_BAD_REQUEST ) - 1,
45804611 "NetX HTTP Receive Timeout",
45814612 sizeof("NetX HTTP Receive Timeout") - 1, NX_NULL, 0);
45824613
4583- /* Error, return to caller. */
4584- return;
4614+ goto put_process_end;
45854615 }
45864616
45874617 if (server_ptr -> nx_web_http_server_request_chunked)
@@ -4611,12 +4641,28 @@ UINT temp_realm_length = 0;
46114641 /* Release the previous data packet. */
46124642 nx_packet_release(data_packet_ptr);
46134643
4614- /* Error, return to caller. */
4615- return;
4644+ goto put_process_end;
46164645 }
46174646
46184647 /* Update the length. */
4619- length = length - (UINT)(next_packet_ptr -> nx_packet_append_ptr - next_packet_ptr -> nx_packet_prepend_ptr);
4648+ consumed_length = (ULONG)(next_packet_ptr -> nx_packet_append_ptr - next_packet_ptr -> nx_packet_prepend_ptr);
4649+ if ((length - consumed_length) > length)
4650+ {
4651+ /* Underflow error has occurred.*/
4652+
4653+ /* Send response back to HTTP Client. */
4654+ _nx_web_http_server_response_send(server_ptr, NX_WEB_HTTP_STATUS_BAD_REQUEST,
4655+ sizeof(NX_WEB_HTTP_STATUS_BAD_REQUEST) - 1,
4656+ "NetX HTTP Content Length",
4657+ sizeof("NetX HTTP Content Length") - 1, NX_NULL, 0);
4658+
4659+ /* Release the previous data packet. */
4660+ nx_packet_release(data_packet_ptr);
4661+
4662+ status = NX_UNDERFLOW;
4663+ goto put_process_end;
4664+ }
4665+ length -= consumed_length;
46204666
46214667 /* Increment the bytes received count. */
46224668 server_ptr -> nx_web_http_server_total_bytes_received = server_ptr -> nx_web_http_server_total_bytes_received +
@@ -4635,11 +4681,8 @@ UINT temp_realm_length = 0;
46354681 nx_packet_release(data_packet_ptr);
46364682 }
46374683
4638- /* Success, at this point close the file and prepare a successful response for the client. */
4639- fx_file_close(&(server_ptr -> nx_web_http_server_file));
4640-
4641-
4642- /* Now build a response header. */
4684+ /* Build a response header. No need to check for success up to this point, as
4685+ program will have jumped to put_process_end label if an error has occurred. */
46434686 status = _nx_web_http_server_generate_response_header(server_ptr, &data_packet_ptr, NX_WEB_HTTP_STATUS_OK,
46444687 sizeof(NX_WEB_HTTP_STATUS_OK) - 1, 0,
46454688 NX_NULL, 0, NX_NULL, 0);
@@ -4657,7 +4700,10 @@ UINT temp_realm_length = 0;
46574700 nx_packet_release(data_packet_ptr);
46584701 }
46594702 }
4660-
4703+ put_process_end:
4704+ /* Always attempt cleanup by closing the file. */
4705+ fx_file_close(&(server_ptr -> nx_web_http_server_file));
4706+ return;
46614707}
46624708
46634709
@@ -11350,4 +11396,4 @@ UINT _nx_web_http_server_authentication_check_set(NX_WEB_HTTP_SERVER *http_serve
1135011396
1135111397 /* Return success. */
1135211398 return(NX_SUCCESS);
11353- }
11399+ }
0 commit comments