authorgravatar for truemedian@gmail.comNameless <truemedian@gmail.com> 2023-10-17 19:08:22-05:00
committergravatar for truemedian@gmail.comNameless <truemedian@gmail.com> 2023-10-21 20:52:59-05:00
log7dd3099519fd0f64fcdf11791fc9ba95a68e0637
treefadcb414b73af472573a12e3e5abba1ce1ac6ba0
parent363d0ee5e13f4ac3a93d246121edfd00ef9fd97b
signature Commit is signed but in an unrecognized format.

std.http: fix crashes found via fuzzing

4 files changed, 33 insertions(+), 11 deletions(-)

lib/std/http.zig+2-1
......@@ -35,7 +35,8 @@ pub const Method = enum(u64) { // TODO: should be u192 or u256, but neither is s
3535 /// Asserts that `s` is 24 or fewer bytes.
3636 pub fn parse(s: []const u8) u64 {
3737 var x: u64 = 0;
38 @memcpy(std.mem.asBytes(&x)[0..s.len], s);
38 const len = @min(s.len, @sizeOf(@TypeOf(x)));
39 @memcpy(std.mem.asBytes(&x)[0..len], s[0..len]);
3940 return x;
4041 }
4142
lib/std/http/Client.zig+23-5
......@@ -15,7 +15,7 @@ const proto = @import("protocol.zig");
1515pub const disable_tls = std.options.http_disable_tls;
1616
1717allocator: Allocator,
18ca_bundle: std.crypto.Certificate.Bundle = .{},
18ca_bundle: if (disable_tls) void else std.crypto.Certificate.Bundle = if (disable_tls) {} else .{},
1919ca_bundle_mutex: std.Thread.Mutex = .{},
2020
2121/// When this is `true`, the next time this client performs an HTTPS request,
......@@ -386,7 +386,7 @@ pub const Response = struct {
386386 };
387387
388388 pub fn parse(res: *Response, bytes: []const u8, trailing: bool) ParseError!void {
389 var it = mem.tokenizeAny(u8, bytes[0 .. bytes.len - 4], "\r\n");
389 var it = mem.tokenizeAny(u8, bytes, "\r\n");
390390
391391 const first_line = it.next() orelse return error.HttpHeadersInvalid;
392392 if (first_line.len < 12)
......@@ -405,6 +405,8 @@ pub const Response = struct {
405405 res.status = status;
406406 res.reason = reason;
407407
408 res.headers.clearRetainingCapacity();
409
408410 while (it.next()) |line| {
409411 if (line.len == 0) return error.HttpHeadersInvalid;
410412 switch (line[0]) {
......@@ -525,6 +527,7 @@ pub const Request = struct {
525527
526528 redirects_left: u32,
527529 handle_redirects: bool,
530 handle_continue: bool,
528531
529532 response: Response,
530533
......@@ -758,6 +761,10 @@ pub const Request = struct {
758761 if (req.response.status == .@"continue") {
759762 req.response.parser.done = true; // we're done parsing the continue response, reset to prepare for the real response
760763 req.response.parser.reset();
764
765 if (req.handle_continue)
766 continue;
767
761768 break;
762769 }
763770
......@@ -897,8 +904,6 @@ pub const Request = struct {
897904 }
898905
899906 if (has_trail) {
900 req.response.headers.clearRetainingCapacity();
901
902907 // The response headers before the trailers are already guaranteed to be valid, so they will always be parsed again and cannot return an error.
903908 // This will *only* fail for a malformed trailer.
904909 req.response.parse(req.response.parser.header_bytes.items, true) catch return error.InvalidTrailers;
......@@ -999,7 +1004,9 @@ pub fn deinit(client: *Client) void {
9991004 proxy.headers.deinit();
10001005 }
10011006
1002 client.ca_bundle.deinit(client.allocator);
1007 if (!disable_tls)
1008 client.ca_bundle.deinit(client.allocator);
1009
10031010 client.* = undefined;
10041011}
10051012
......@@ -1315,6 +1322,14 @@ pub const RequestError = ConnectTcpError || ConnectErrorPartial || Request.SendE
13151322pub const RequestOptions = struct {
13161323 version: http.Version = .@"HTTP/1.1",
13171324
1325 /// Automatically ignore 100 Continue responses. This assumes you don't care, and will have sent the body before you
1326 /// wait for the response.
1327 ///
1328 /// If this is not the case AND you know the server will send a 100 Continue, set this to false and wait for a
1329 /// response before sending the body. If you wait AND the server does not send a 100 Continue before you finish the
1330 /// request, then the request *will* deadlock.
1331 handle_continue: bool = true,
1332
13181333 handle_redirects: bool = true,
13191334 max_redirects: u32 = 3,
13201335 header_strategy: StorageStrategy = .{ .dynamic = 16 * 1024 },
......@@ -1361,6 +1376,8 @@ pub fn open(client: *Client, method: http.Method, uri: Uri, headers: http.Header
13611376 const host = uri.host orelse return error.UriMissingHost;
13621377
13631378 if (protocol == .tls and @atomicLoad(bool, &client.next_https_rescan_certs, .Acquire)) {
1379 if (disable_tls) unreachable;
1380
13641381 client.ca_bundle_mutex.lock();
13651382 defer client.ca_bundle_mutex.unlock();
13661383
......@@ -1381,6 +1398,7 @@ pub fn open(client: *Client, method: http.Method, uri: Uri, headers: http.Header
13811398 .version = options.version,
13821399 .redirects_left = options.max_redirects,
13831400 .handle_redirects = options.handle_redirects,
1401 .handle_continue = options.handle_continue,
13841402 .response = .{
13851403 .status = undefined,
13861404 .reason = undefined,
lib/std/http/Headers.zig+7-4
......@@ -14,15 +14,18 @@ pub const CaseInsensitiveStringContext = struct {
1414 pub fn hash(self: @This(), s: []const u8) u64 {
1515 _ = self;
1616 var buf: [64]u8 = undefined;
17 var i: u8 = 0;
17 var i: usize = 0;
1818
1919 var h = std.hash.Wyhash.init(0);
20 while (i < s.len) : (i += 64) {
21 const left = @min(64, s.len - i);
22 const ret = ascii.lowerString(buf[0..], s[i..][0..left]);
20 while (i + 64 < s.len) : (i += 64) {
21 const ret = ascii.lowerString(buf[0..], s[i..][0..64]);
2322 h.update(ret);
2423 }
2524
25 const left = @min(64, s.len - i);
26 const ret = ascii.lowerString(buf[0..], s[i..][0..left]);
27 h.update(ret);
28
2629 return h.final();
2730 }
2831
lib/std/http/Server.zig+1-1
......@@ -178,7 +178,7 @@ pub const Request = struct {
178178 };
179179
180180 pub fn parse(req: *Request, bytes: []const u8) ParseError!void {
181 var it = mem.tokenizeAny(u8, bytes[0 .. bytes.len - 4], "\r\n");
181 var it = mem.tokenizeAny(u8, bytes, "\r\n");
182182
183183 const first_line = it.next() orelse return error.HttpHeadersInvalid;
184184 if (first_line.len < 10)