Re: httpd errdocs bug

Lloyd <[email protected]> Fri, 19 Jun 2026 01:14:00 +0000
Newsgroups gmane.os.openbsd.bugs
Message-ID <DFEP7FyE5lsci5l8A83Dct_93xQOVN1yGU80FXmf5cHVDn-sQoan7XYaH0al6mx2ebsozyGlEosHVZeS4z2VebAOehVvViLiVXCaTuBnxvc=@proton.me>
I do suspect a bug in the errdocs code but unrelated to file size.

server_abort_http() uses strlen() to re-calculate the Content-Length of the
errdoc. This is very wrong because embedded NULs in the file body will caus=
e
a truncated value. A NUL at 40k will cause it to be truncated as such.

AFAIK 0x00 are valid characters in Unicode response bodies.

read_errdoc() should be modified to return the number of bytes read from
fstat(). It does calculate this but the value is discarded and not returned=
.

Oddly the comments for read_errdoc() do not match the code that follows,
because it returns a pointer to the file contents, not a length:

/*
 * return -1 on failure, strlen() of read file otherwise.
 * body is NULL on failure, contents of file with trailing \0 otherwise.
 */

The mismatched documentation has been there since the original commit.

Regards
Lloyd

=D0=A4=D1=91=D0=B4=D0=BE=D1=80 <[email protected]> wrote:

> error in errdocs in httpd. when creating a large html page for an error, =
it truncates it to 40 kilobytes.