Detach HTTP handler if MG_EV_HTTP_HDRS changes c->recv

This commit is contained in:
Sergey Lyubka 2024-09-18 13:30:27 +01:00
parent eb6a8afe8d
commit c1b703a039
2 changed files with 13 additions and 0 deletions

View File

@ -3227,6 +3227,7 @@ static void http_cb(struct mg_connection *c, int ev, void *ev_data) {
int n = mg_http_parse(buf, c->recv.len - ofs, &hm);
struct mg_str *te; // Transfer - encoding header
bool is_chunked = false;
size_t old_len = c->recv.len;
if (n < 0) {
// We don't use mg_error() here, to avoid closing pipelined requests
// prematurely, see #2592
@ -3238,6 +3239,11 @@ static void http_cb(struct mg_connection *c, int ev, void *ev_data) {
}
if (n == 0) break; // Request is not buffered yet
mg_call(c, MG_EV_HTTP_HDRS, &hm); // Got all HTTP headers
if (c->recv.len != old_len) {
// User manipulated received data. Wash our hands
c->pfn = NULL;
return;
}
if (ev == MG_EV_CLOSE) { // If client did not set Content-Length
hm.message.len = c->recv.len - ofs; // and closes now, deliver MSG
hm.body.len = hm.message.len - (size_t) (hm.body.buf - hm.message.buf);

View File

@ -1011,6 +1011,7 @@ static void http_cb(struct mg_connection *c, int ev, void *ev_data) {
int n = mg_http_parse(buf, c->recv.len - ofs, &hm);
struct mg_str *te; // Transfer - encoding header
bool is_chunked = false;
size_t old_len = c->recv.len;
if (n < 0) {
// We don't use mg_error() here, to avoid closing pipelined requests
// prematurely, see #2592
@ -1022,6 +1023,12 @@ static void http_cb(struct mg_connection *c, int ev, void *ev_data) {
}
if (n == 0) break; // Request is not buffered yet
mg_call(c, MG_EV_HTTP_HDRS, &hm); // Got all HTTP headers
if (c->recv.len != old_len) {
// User manipulated received data. Wash our hands
MG_DEBUG(("%lu detaching HTTP handler", c->id));
c->pfn = NULL;
return;
}
if (ev == MG_EV_CLOSE) { // If client did not set Content-Length
hm.message.len = c->recv.len - ofs; // and closes now, deliver MSG
hm.body.len = hm.message.len - (size_t) (hm.body.buf - hm.message.buf);