Re: [PATCH] Fix header parsing bug with malicious header fields

Hi,

>diff --git a/src/cache.c b/src/cache.c
>index 154bef5c..5bd8a5dc 100644
>--- a/src/cache.c
>+++ b/src/cache.c
>@@ -287,7 +287,7 @@ static int Cache_bufsize(CacheEntry_t *e)
>  * Inject full page content directly into the cache.
>  * Used for "about:splash". May be used for "about:cache" too.
>  *
>- * The @param data_ds buffer is copied into the entry buffer, so it is
>+ * @param buf is copied into the entry buffer, so it is the
>  * responsibility of the caller to free it.
>  */
> void a_Cache_entry_inject(const DilloUrl *Url,
>@@ -765,9 +765,8 @@ static Dlist *Cache_parse_multiple_fields(const char *header,
>             j--;
>          field = dStrndup(header + i, j);
>          dList_append(fields, field);
>-      } else {
>-         while (header[i] != '\n') i++;
>       }
>+      while (header[i] != '\n') i++;
>    }
>
>    if (dList_length(fields) == 0) {

Thanks!, merged in two commits with a comment:

https://git.dillo-browser.org/dillo/commit/?id=7ed29a43c18a960946fe47f37004bb9677d0a1df
https://git.dillo-browser.org/dillo/commit/?id=9b7b799c7e47ca6e2b91aec82bd58547cc4ba38c

Best,
Rodrigo.
_______________________________________________
Dillo-dev mailing list -- dillo-dev-lx9mn2B4QYRWk0Htik3J/[email protected]
To unsubscribe send an email to dillo-dev-leave-lx9mn2B4QYRWk0Htik3J/[email protected]