ychat: fix crash on malformed GET/POST request line (uncaught exception)

sock::handle_client_read computed `s_buf.find(" HTTP", 0) + 1` directly
into an int for both the GET and POST request-line parsers. When a
request has no " HTTP" token at all (e.g. a scanner sending a bare
"GET" with no path/version and closing the connection), find() returns
string::npos and the "+ 1" wraps a 64-bit npos to 0 before the result
is ever compared against string::npos, so the intended invalid-request
guard never fired. Execution fell through to substr(5, ...), which
throws std::out_of_range whenever the received buffer is shorter than
5 bytes -- an uncaught exception that kills the whole process (seen
live on f3s: a vulnerability-scanner probe crashed the pod twice).

Fixed by checking find()'s result for npos, and requiring at least 5
bytes to extract from, before doing any arithmetic on it -- both cases
now hit the existing "invalid request" (HTTPERR) path instead.

Reproduced against the previously deployed image (b8d28a1): a raw
3-byte "GET" with an immediate connection close crashed it every time.
The fixed build survives that plus a batch of other short/malformed
request lines (bare "GET"/"POST" variants, truncated methods, empty
requests), while register/login/wrong-password behavior is unchanged.

0 files changed, 0 insertions, 0 deletions