Skip to content

Commit 34a8a74

Browse files
jjm2473hauke
authored andcommitted
uhttpd/file: fix string out of buffer range on uh_defer_script
if a url path length is multiple of 8, tailing zero will be trimed out on uh_defer_script, cause a strangle error. it's simple to reproduce. 1. create a luci controller, register a entry with path length multiple of 8 (including '/cgi-bin/'), for example, '/cgi-bin/luci/admin/system/admin'. 2. set uhttpd max_requests to 1, and restart uhttpd 3. request '/cgi-bin/luci/admin/system/admin' with at least 2 process 4. some responses will produce a error: ``` Unable to launch the requested CGI program: /www/cgi-bin/luci: No such file or directory ``` Signed-off-by: Liangbin Lian <jjm2473@gmail.com>
1 parent 47561aa commit 34a8a74

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

file.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -797,7 +797,7 @@ uh_defer_script(struct client *cl, struct dispatch_handler *d, char *url, struct
797797
/* allocate enough memory to duplicate all path_info strings in one block */
798798
#undef _field
799799
#define _field(_name) &_##_name, field_len(pi->_name),
800-
dr = calloc_a(sizeof(*dr), &_url, strlen(url), path_info_fields NULL);
800+
dr = calloc_a(sizeof(*dr), &_url, strlen(url) + 1, path_info_fields NULL);
801801

802802
memcpy(&dr->pi, pi, sizeof(*pi));
803803
dr->path = true;
@@ -807,7 +807,7 @@ uh_defer_script(struct client *cl, struct dispatch_handler *d, char *url, struct
807807
#define _field(_name) if (pi->_name) dr->pi._name = strcpy(_##_name, pi->_name);
808808
path_info_fields
809809
} else {
810-
dr = calloc_a(sizeof(*dr), &_url, strlen(url), NULL);
810+
dr = calloc_a(sizeof(*dr), &_url, strlen(url) + 1, NULL);
811811
}
812812

813813
cl->dispatch.req_data = dr;

0 commit comments

Comments
 (0)