Bug in http.c (parse_url())
Vjacheslav Chekushin <[email protected]>
| Newsgroups | gmane.comp.mobile.kannel.devel |
|---|---|
| Organization | LMT |
| Message-ID | <[email protected]> |
Hi, list. There is a bug in http.c in function parse_url(). If we will try to send request like http://[email protected] then after: at = octstr_search_char(url, '@', prefix_len); if ( at != -1 ) { if ((slash == -1 || ( slash != -1 && at < slash))) { auth_sep = octstr_search_char(url, ':', prefix_len); if (auth_sep != -1 && (auth_sep < at)) { octstr_set_char(url, auth_sep, '@'); colon = octstr_search_char(url, ':', prefix_len); } } else { at = -1; } } we will have at!=-1 and auth_sep=-1 So later: if (at != -1) { int at2, i; at2 = octstr_search_char(url, '@', prefix_len); *username = octstr_copy(url, prefix_len, at2 - prefix_len); if (at2 != at) *password = octstr_copy(url, at2 + 1, at - at2 - 1); else *password = NULL; /* Must be inserted to avoid segmentation fault if (auth_sep != -1) */ octstr_set_char(url, auth_sep, ':'); for(i = at2 + 1; i < at ; i++) octstr_set_char(url, i, '*'); host_len = host_len - at + prefix_len - 1; prefix_len = at + 1; } -- Vjacheslav Chekushin mailto:[email protected] Latvian Mobile Phone Company http://www.lmt.lv