uhttpd/file: fix string out of buffer range on uh_defer_script

[project/uhttpd.git] / client.c

diff --git a/client.c b/client.c
index 6233d01cd43508c6a9f15026985da21abead8cce..c037cc79874855999fb849c03e064a7f6a99072b 100644 (file)
--- a/client.c
+++ b/client.c
@@ -138,6 +138,7 @@ void uh_request_done(struct client *cl)
 void __printf(4, 5)
 uh_client_error(struct client *cl, int code, const char *summary, const char *fmt, ...)
 {
+       struct http_request *r = &cl->request;
        va_list arg;
 
        uh_http_header(cl, code, summary);
@@ -151,6 +152,17 @@ uh_client_error(struct client *cl, int code, const char *summary, const char *fm
                va_end(arg);
        }
 
+       /* Close the connection even when keep alive is set, when it
+        * contains a request body, as it was not read and we are
+        * currently out of sync. Without handling this the body will be
+        * interpreted as part of the next request. The alternative
+        * would be to read and discard the request body here.
+        */
+       if (r->transfer_chunked || r->content_length > 0) {
+               cl->state = CLIENT_STATE_CLOSE;
+               cl->request.connection_close = true;
+       }
+
        uh_request_done(cl);
 }
 
@@ -251,10 +263,10 @@ static bool tls_redirect_check(struct client *cl)
                return true;
 
        blob_for_each_attr(cur, cl->hdr.head, rem) {
-               if (!strcmp(blobmsg_name(cur), "host"))
+               if (!strncmp(blobmsg_name(cur), "host", 4))
                        host = blobmsg_get_string(cur);
 
-               if (!strcmp(blobmsg_name(cur), "URL"))
+               if (!strncmp(blobmsg_name(cur), "URL", 3))
                        url = blobmsg_get_string(cur);
 
                if (url && host)
@@ -520,7 +532,8 @@ void uh_client_read_cb(struct client *cl)
 
                if (!read_cbs[cl->state](cl, str, len)) {
                        if (len == us->r.buffer_len &&
-                           cl->state != CLIENT_STATE_DATA)
+                           cl->state != CLIENT_STATE_DATA &&
+                           cl->state != CLIENT_STATE_DONE)
                                uh_header_error(cl, 413, "Request Entity Too Large");
                        break;
                }