HTTP parser: restricting control chars in header fields values.

VBart · VBart · commit 477e8177b70a · 2018-01-24T15:02:56.000+03:00
This also fixes an infinite loop here (found with honggfuzz).
diff --git a/src/nxt_http_parse.c b/src/nxt_http_parse.c
@@ -650,9 +650,7 @@ nxt_http_parse_field_value(nxt_http_request_parse_t *rp, u_char **pos,
             break;
         }
 
-        if (ch == '\0') {
-            return NXT_HTTP_PARSE_INVALID;
-        }
+        return NXT_HTTP_PARSE_INVALID;
     }
 
     if (nxt_fast_path(p != *pos)) {

Original file line number	Diff line number	Diff line change
`@@ -650,9 +650,7 @@ nxt_http_parse_field_value(nxt_http_request_parse_t rp, u_char *pos,`
`650`	`650`	`break;`
`651`	`651`	`}`
`652`	`652`
`653`		`- if (ch == '\0') {`
`654`		`- return NXT_HTTP_PARSE_INVALID;`
`655`		`- }`
	`653`	`+ return NXT_HTTP_PARSE_INVALID;`
`656`	`654`	`}`
`657`	`655`
`658`	`656`	`if (nxt_fast_path(p != *pos)) {`