ubus: duplicate request buffer to avoid memory corruption with multiple requests

[project/uhttpd.git] / relay.c

diff --git a/relay.c b/relay.c
index 81e7736..6195349 100644 (file)
--- a/relay.c
+++ b/relay.c
@@ -1,20 +1,20 @@
 /*
  * uhttpd - Tiny single-threaded httpd
  *
- *   Copyright (C) 2010-2012 Jo-Philipp Wich <xm@subsignal.org>
- *   Copyright (C) 2012 Felix Fietkau <nbd@openwrt.org>
+ *   Copyright (C) 2010-2013 Jo-Philipp Wich <xm@subsignal.org>
+ *   Copyright (C) 2013 Felix Fietkau <nbd@openwrt.org>
  *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
  *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
 #include <signal.h>
@@ -28,6 +28,7 @@ void uh_relay_free(struct relay *r)
        if (r->proc.pending)
                kill(r->proc.pid, SIGKILL);
 
+       uloop_timeout_cancel(&r->timeout);
        uloop_process_delete(&r->proc);
        ustream_free(&r->sfd.stream);
        close(r->sfd.fd.fd);
@@ -55,6 +56,7 @@ static void relay_error(struct relay *r)
        struct ustream *s = &r->sfd.stream;
        int len;
 
+       r->error = true;
        s->eof = true;
        ustream_get_read_buf(s, &len);
        if (len)
@@ -76,6 +78,9 @@ static void relay_process_headers(struct relay *r)
                char *val;
 
                buf = ustream_get_read_buf(s, &len);
+               if (!buf || !len)
+                       break;
+
                newline = strchr(buf, '\n');
                if (!newline)
                        break;
@@ -112,7 +117,11 @@ static void relay_read_cb(struct ustream *s, int bytes)
        char *buf;
        int len;
 
-       relay_process_headers(r);
+       if (r->process_done)
+               uloop_timeout_set(&r->timeout, 1);
+
+       if (!r->error)
+               relay_process_headers(r);
 
        if (r->header_cb) {
                /*
@@ -130,15 +139,21 @@ static void relay_read_cb(struct ustream *s, int bytes)
        }
 
        buf = ustream_get_read_buf(s, &len);
+       if (!buf || !len)
+               return;
+
        uh_chunk_write(cl, buf, len);
        ustream_consume(s, len);
 }
 
-static void relay_close_if_done(struct relay *r)
+static void relay_close_if_done(struct uloop_timeout *timeout)
 {
+       struct relay *r = container_of(timeout, struct relay, timeout);
        struct ustream *s = &r->sfd.stream;
 
-       if (!s->eof || ustream_pending_data(s, false))
+       while (ustream_poll(&r->sfd.stream));
+
+       if (!(r->process_done || s->eof) || ustream_pending_data(s, false))
                return;
 
        uh_relay_close(r, r->ret);
@@ -149,7 +164,7 @@ static void relay_state_cb(struct ustream *s)
        struct relay *r = container_of(s, struct relay, sfd.stream);
 
        if (r->process_done)
-               relay_close_if_done(r);
+               uloop_timeout_set(&r->timeout, 1);
 }
 
 static void relay_proc_cb(struct uloop_process *proc, int ret)
@@ -158,7 +173,16 @@ static void relay_proc_cb(struct uloop_process *proc, int ret)
 
        r->process_done = true;
        r->ret = ret;
-       relay_close_if_done(r);
+       uloop_timeout_set(&r->timeout, 1);
+}
+
+void uh_relay_kill(struct client *cl, struct relay *r)
+{
+       struct ustream *us = &r->sfd.stream;
+
+       kill(r->proc.pid, SIGKILL);
+       us->eof = true;
+       ustream_state_change(us);
 }
 
 void uh_relay_open(struct client *cl, struct relay *r, int fd, int pid)
@@ -174,4 +198,6 @@ void uh_relay_open(struct client *cl, struct relay *r, int fd, int pid)
        r->proc.pid = pid;
        r->proc.cb = relay_proc_cb;
        uloop_process_add(&r->proc);
+
+       r->timeout.cb = relay_close_if_done;
 }