fix use-after-realloc issue with the request url

diff --git a/client.c b/client.c
index 28c8f76..2fdc1b2 100644 (file)
--- a/client.c
+++ b/client.c
@@ -142,9 +142,9 @@ static int client_parse_request(struct client *cl, char *data)
        if (!type || !path || !version)
                return CLIENT_STATE_DONE;
 
        if (!type || !path || !version)
                return CLIENT_STATE_DONE;
 

-       memset(&cl->request, 0, sizeof(cl->request));
-       req->url = path;
+       blobmsg_add_string(&cl->hdr, "URL", path);

 
 

+       memset(&cl->request, 0, sizeof(cl->request));

        h_method = find_idx(http_methods, ARRAY_SIZE(http_methods), type);
        h_version = find_idx(http_versions, ARRAY_SIZE(http_versions), version);
        if (h_method < 0 || h_version < 0) {
        h_method = find_idx(http_methods, ARRAY_SIZE(http_methods), type);
        h_version = find_idx(http_versions, ARRAY_SIZE(http_versions), version);
        if (h_method < 0 || h_version < 0) {


@@ -168,9 +168,8 @@ static bool client_init_cb(struct client *cl, char *buf, int len)
 
        *newline = 0;
        blob_buf_init(&cl->hdr, 0);
 
        *newline = 0;
        blob_buf_init(&cl->hdr, 0);

-       blobmsg_add_string(&cl->hdr, "REQUEST", buf);
+       cl->state = client_parse_request(cl, buf);

        ustream_consume(cl->us, newline + 2 - buf);
        ustream_consume(cl->us, newline + 2 - buf);

-       cl->state = client_parse_request(cl, (char *) blobmsg_data(blob_data(cl->hdr.head)));

        if (cl->state == CLIENT_STATE_DONE)
                uh_header_error(cl, 400, "Bad Request");
 
        if (cl->state == CLIENT_STATE_DONE)
                uh_header_error(cl, 400, "Bad Request");
 

diff --git a/file.c b/file.c
index 679755d..e95a165 100644 (file)
--- a/file.c
+++ b/file.c
@@ -685,7 +685,7 @@ static bool __handle_file_request(struct client *cl, const char *url)
 void uh_handle_request(struct client *cl)
 {
        struct dispatch_handler *d;
 void uh_handle_request(struct client *cl)
 {
        struct dispatch_handler *d;

-       const char *url = cl->request.url;
+       const char *url = blobmsg_data(blob_data(cl->hdr.head));;

 
        d = dispatch_find(url, NULL);
        if (d) {
 
        d = dispatch_find(url, NULL);
        if (d) {


@@ -697,5 +697,5 @@ void uh_handle_request(struct client *cl)
            __handle_file_request(cl, conf.error_handler))
                return;
 
            __handle_file_request(cl, conf.error_handler))
                return;
 

-       uh_client_error(cl, 404, "Not Found", "The requested URL %s was not found on this server.", cl->request.url);
+       uh_client_error(cl, 404, "Not Found", "The requested URL %s was not found on this server.", url);

 }
 }

diff --git a/proc.c b/proc.c
index 351b473..425576e 100644 (file)
--- a/proc.c
+++ b/proc.c
@@ -123,9 +123,11 @@ struct env_var *uh_get_process_vars(struct client *cl, struct path_info *pi)
        struct blob_attr *data = cl->hdr.head;
        struct env_var *vars = (void *) uh_buf;
        struct blob_attr *tb[__HDR_MAX];
        struct blob_attr *data = cl->hdr.head;
        struct env_var *vars = (void *) uh_buf;
        struct blob_attr *tb[__HDR_MAX];

+       const char *url;

        int len;
        int i;
 
        int len;
        int i;
 

+       url = blobmsg_data(blob_data(cl->hdr.head));

        len = ARRAY_SIZE(proc_header_env);
        len += ARRAY_SIZE(extra_vars);
        len *= sizeof(struct env_var);
        len = ARRAY_SIZE(proc_header_env);
        len += ARRAY_SIZE(extra_vars);
        len *= sizeof(struct env_var);


@@ -136,7 +138,7 @@ struct env_var *uh_get_process_vars(struct client *cl, struct path_info *pi)
        extra_vars[VAR_SCRIPT_FILE].value = pi->phys;
        extra_vars[VAR_DOCROOT].value = pi->root;
        extra_vars[VAR_QUERY].value = pi->query ? pi->query : "";
        extra_vars[VAR_SCRIPT_FILE].value = pi->phys;
        extra_vars[VAR_DOCROOT].value = pi->root;
        extra_vars[VAR_QUERY].value = pi->query ? pi->query : "";

-       extra_vars[VAR_REQUEST].value = req->url;
+       extra_vars[VAR_REQUEST].value = url;

        extra_vars[VAR_PROTO].value = http_versions[req->version];
        extra_vars[VAR_METHOD].value = http_methods[req->method];
        extra_vars[VAR_PATH_INFO].value = pi->info;
        extra_vars[VAR_PROTO].value = http_versions[req->version];
        extra_vars[VAR_METHOD].value = http_methods[req->method];
        extra_vars[VAR_PATH_INFO].value = pi->info;

diff --git a/uhttpd.h b/uhttpd.h
index b2404f4..5ec0f00 100644 (file)
--- a/uhttpd.h
+++ b/uhttpd.h
@@ -82,7 +82,6 @@ struct http_request {
        int content_length;
        bool expect_cont;
        uint8_t transfer_chunked;
        int content_length;
        bool expect_cont;
        uint8_t transfer_chunked;

-       const char *url;

        const struct auth_realm *realm;
 };
 
        const struct auth_realm *realm;
 };