Skip to content

Incomplete query strings lead to lockup of request parser #15

@peschuster

Description

@peschuster

After the security fix in PR #14 incomplete query parameters (e.g. /test?foo=bar& or just /test?) lead to a lockup of the HTTP request parser: in HTTPsReq_Handle the value of RxBufLenRem stays at 1 with just the trailing CR (and LF) at RxBufPtr.

Before the patches RxBufLenRem was 0 at this point.

I'd suggest to add the following line
len_rd += len
here (between lines 1191 and 1193):

if (key_val_pair_len == 0u){ /* In the case it's null, the query has been fully ... */
*p_err = HTTPs_ERR_NONE; /* ...parsed and it has finished by a '&'. */
goto exit_update;
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions