Return error when bad method starts with M or C

felixge · Jun 10, 2011 · dc314a3 · dc314a3
1 parent d34a2ad
commit dc314a3
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/http_parser.c b/http_parser.c
@@ -632,6 +632,8 @@ size_t http_parser_execute (http_parser *parser,
  parser->method = HTTP_CHECKOUT;
  } else if (index == 2 && ch == 'P') {
  parser->method = HTTP_COPY;
+ } else {
+ goto error;
  }
  } else if (parser->method == HTTP_MKCOL) {
  if (index == 1 && ch == 'O') {
@@ -642,6 +644,8 @@ size_t http_parser_execute (http_parser *parser,
  parser->method = HTTP_MSEARCH;
  } else if (index == 2 && ch == 'A') {
  parser->method = HTTP_MKACTIVITY;
+ } else {
+ goto error;
  }
  } else if (index == 1 && parser->method == HTTP_POST && ch == 'R') {
  parser->method = HTTP_PROPFIND; /* or HTTP_PROPPATCH */

diff --git a/test.c b/test.c
@@ -1937,6 +1937,16 @@ main (void)
  test_simple(buf, 1);
  }
 
+ static const char *bad_methods[] = {
+ "C******",
+ "M****",
+ 0 };
+ for (this_method = bad_methods; *this_method; this_method++) {
+ char buf[200];
+ sprintf(buf, "%s / HTTP/1.1\r\n\r\n", *this_method);
+ test_simple(buf, 0);
+ }
+
  const char *dumbfuck2 =
  "GET / HTTP/1.1\r\n"
  "X-SSL-Bullshit: -----BEGIN CERTIFICATE-----\r\n"