From eb46afd5d10b0d2c95a90eade231d519415bdd80 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Tue, 7 Jul 2026 15:07:09 +0300 Subject: yhttpd: fix malformed Content-Length crash and unchecked accept Two residual stability bugs in yhttpd's own sock.cpp (ychat never had them -- yhttpd's read_http request parser is structurally different from ychat's), found while auditing for ychat engine-fix backports: 1. sock::read_http malformed Content-Length crash (a3908e1-class). read_http matched the header on the 15-char prefix "Content-Length:" (no space required) but then assumed the canonical "Content-Length: " form and substr'd from index 16. Two reachable crash cases for any unauthenticated client: - bare "Content-Length:" (15 chars): substr(16, len-16) had pos > size -> std::out_of_range throw -> uncaught -> process crash. - "Content-Length:\n" (16 chars, no value): the substring was empty so the do/while digit scan read past the buffer (OOB read) until a stray '\n' in adjacent memory. Now guarded: require the space separator + a value before substr, and bound the scan to the substring length. Verified in Docker: both malformed cases close gracefully, a valid Content-Length: 0 POST still returns 200, server stays up. 2. sock::start unchecked accept(). The accept() return was used unchecked; on failure (fd == -1, e.g. EMFILE/ENFILE under fd exhaustion, EINTR) FD_SET(-1, &active_fd_set) is UB (bit-op on a negative index) and the later _create_container(-1) would read/write fd -1 (EBADF). Now bails with ACCPERR and continues on any accept error (the accept-bail half of ychat's 1c36abe, which the original yhttpd port only carried the size_t->socklen_t init of). yhttpd is not deployed to the cluster (no Helm chart/ArgoCD app); this is a build-and-verify-in-Docker project, so no deploy step. ycurses shares no socket/template engine with ychat (it is a standalone curses library demo) so nothing applies there. --- yhttpd/src/sock/sock.cpp | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) (limited to 'yhttpd/src') diff --git a/yhttpd/src/sock/sock.cpp b/yhttpd/src/sock/sock.cpp index 279123d..b8ce6ce 100644 --- a/yhttpd/src/sock/sock.cpp +++ b/yhttpd/src/sock/sock.cpp @@ -228,6 +228,24 @@ sock::read_http(socketcontainer *p_sock, char *c_zbuf, int i_buflen, int &i_post if (s_line.compare(0, 15, "Content-Length:")) continue; + // Malformed Content-Length guard. The match above is on the 15-char + // prefix "Content-Length:" with no space required, but the code below + // assumes the canonical "Content-Length: " form (it substrs from + // index 16, skipping the space at index 15). Two crash cases leaked + // through: + // - "Content-Length:" (15 chars, no space/value): substr(16, len-16) + // had pos > size -> std::out_of_range throw -> uncaught -> process + // crash. + // - "Content-Length:\n" (16 chars, no value): s_content_length ended + // up empty, and the do/while digit scan read s_content_length[z] + // past the buffer (OOB read) until a stray '\n' appeared in + // adjacent memory. + // Require the space separator and at least one char of value + // (length > 16) before substr, and bound the scan to the substring + // length so it can never read past the buffer even with no newline. + if (s_line.length() <= 16 || s_line[15] != ' ') + return -1; + // Match found on Content-Length:... process, and then break out and get us to the promised land s_content_length = s_line.substr( 16 /*strlen("Content-Length: ")*/, s_line.length() - 16 /*strlen("Content-Length: ")*/); @@ -248,7 +266,7 @@ sock::read_http(socketcontainer *p_sock, char *c_zbuf, int i_buflen, int &i_post z++; } - while(ch != '\n'); + while(z < (int)s_content_length.length() && ch != '\n'); break; } @@ -451,6 +469,16 @@ sock::start() size = sizeof(clientname); i_new_sock = accept (i_sock, (struct sockaddr *) &clientname, &size); + // Bail on any accept error (EMFILE/ENFILE under fd exhaustion, + // EINTR, etc.) instead of proceeding with i_new_sock == -1: + // FD_SET(-1, &active_fd_set) is UB (bit-op on a negative index) and + // the later _create_container(-1) would read/write fd -1 (EBADF). + if (i_new_sock < 0) + { + wrap::system_message(ACCPERR); + continue; + } + #ifdef OPENSSL if (_main_loop_do_ssl_stuff(i_new_sock)) -- cgit v1.2.3