[Pound Mailing List] [PATCH] copy_chunks: Signal an error if a terminating chunk is missing

This means that the client disconnected abruptly, without completing the
request. If we proceed waiting for reply from backend without ever completing
the request we'll just wait forever.

Note that this has some security implications as it provides a way for the
client to hit and run, wasting a backend connection while disconnecting his one
(which leads to denial of service).
---
 http.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/http.c b/http.c
index 02242a4..9f8c87d 100644
--- a/http.c
+++ b/http.c
@@ -184,13 +184,19 @@ copy_chunks(BIO *const cl, BIO *const be, LONG *res_bytes, const int no_write, c
     regmatch_t  matches[2];
     int         res;
 
-    for(tot_size = 0L;;) {
+    for(tot_size = 0L, cont = -1L;;) {
+
         if((res = get_line(cl, buf, MAXBUF)) < 0) {
             logmsg(LOG_NOTICE, "(%lx) chunked read error: %s", pthread_self(), strerror(errno));
             return -1;
-        } else if(res > 0)
+        } else if(res > 0) {
             /* EOF */
+            if (cont != 0) {
+                logmsg(LOG_NOTICE, "(%lx) unexpected EOF: no terminating chunk", pthread_self());
+                return -1;
+            }
             return 0;
+        }
         if(!regexec(&CHUNK_HEAD, buf, 2, matches, 0))
             cont = STRTOL(buf, NULL, 16);
         else {
-- 
1.8.3.1


--
To unsubscribe send an email with subject unsubscribe to [email protected]
Please contact [email protected] for questions.