Bug in http.c (parse_url())

Vjacheslav Chekushin <[email protected]>
Newsgroups gmane.comp.mobile.kannel.devel
Organization LMT
Message-ID <[email protected]>
Hi, list.
There is a bug in http.c in function parse_url().
If we will try to send request like http://[email protected]

then after:
      at = octstr_search_char(url, '@', prefix_len);
      if ( at != -1 ) {
          if ((slash == -1 || ( slash != -1 && at < slash))) {
              auth_sep = octstr_search_char(url, ':', prefix_len);

              if (auth_sep != -1 && (auth_sep < at)) {
                  octstr_set_char(url, auth_sep, '@');
                  colon = octstr_search_char(url, ':', prefix_len);
              }
          } else {
              at = -1;
          }
      }
we will have at!=-1 and auth_sep=-1

So later:
      if (at != -1) {
          int at2, i;
          at2 = octstr_search_char(url, '@', prefix_len);
          *username = octstr_copy(url, prefix_len, at2 - prefix_len);

          if (at2 != at)
              *password = octstr_copy(url, at2 + 1, at - at2 - 1);
          else
              *password = NULL;

/* Must be inserted to avoid segmentation fault
          if (auth_sep != -1) */

              octstr_set_char(url, auth_sep, ':');

          for(i = at2 + 1; i < at ; i++)
              octstr_set_char(url, i, '*');
          host_len = host_len - at + prefix_len - 1;
          prefix_len = at + 1;
      }




-- 
Vjacheslav Chekushin                                mailto:[email protected]
Latvian Mobile Phone Company                        http://www.lmt.lv
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.