michaelh/zephyr
1
0
Fork 0
Code Releases Activity

net: lib: http: Fix invalid pointer body_start

Browse source 
The body_start field at http_client_ctx.rsp is used to check if this
fragment contains (a part of) headers or not.

If the device recived more than one fragment in one http response,
may cause re-use of the result buffer in function on_body().

Once the device re-use the result buffer, the body_start that point
to this buffer address will no longer be valid.

Signed-off-by: Ding Tao <miyatsu@qq.com>
This commit is contained in:
Ding Tao 2017-10-25 19:59:52 +08:00 • committed by Jukka Rissanen
commit fb7f6cfa97
1 changed files with 3 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
subsys/net/lib/http/http_client.c
View file

@ -292,7 +292,8 @@ static int on_body(struct http_parser *parser, const char *at, size_t length)
NET_DBG("Processed %zd length %zd", ctx->rsp.processed, length);
if (!ctx->rsp.body_start) {
if ((u8_t *)at != (u8_t *)ctx->rsp.response_buf) {
/* This fragment contains the start of the body */
ctx->rsp.body_start = (u8_t *)at;
}
@ -309,6 +310,7 @@ static int on_body(struct http_parser *parser, const char *at, size_t length)
/* Re-use the result buffer and start to fill it again */
ctx->rsp.data_len = 0;
ctx->rsp.body_start = NULL;
}
return 0;