Skip to content

Commit 0189bb2

Browse files
author
Evgeniy Golovin
committed
OS-FCGI 1.3.2, check invalid headers to prevent crash
1 parent 83847bc commit 0189bb2

File tree

1 file changed

+58
-46
lines changed

1 file changed

+58
-46
lines changed

‎os-fcgi.cpp

Lines changed: 58 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
#include "3rdparty/MPFDParser-1.0/Parser.h"
1111
#include <stdlib.h>
1212

13-
#define OS_FCGI_VERSION OS_TEXT("1.3.1")
13+
#define OS_FCGI_VERSION OS_TEXT("1.3.2")
1414

1515
#include <sys/types.h>
1616
#include <sys/stat.h>
@@ -403,59 +403,71 @@ class FCGX_OS: public OS
403403
const char * form_urlencoded = "application/x-www-form-urlencoded";
404404
int form_urlencoded_len = (int)strlen(form_urlencoded);
405405

406+
bool is_valid_headers = true;
407+
406408
MPFD::Parser POSTParser = MPFD::Parser();
407409
if(content_length > 0 && content_type.getLen() > 0 && strncmp(content_type.toChar(), multipart_form_data, multipart_form_data_len) == 0){
408-
// dolog("begin multipart_form_data");
409-
POSTParser.SetTempDirForFileUpload("/tmp");
410-
// POSTParser.SetMaxCollectedDataLength(20*1024);
411-
POSTParser.SetContentType(content_type.toChar());
412-
413-
int max_temp_buf_size = (int)(1024*1024*0.1);
414-
int temp_buf_size = content_length < max_temp_buf_size ? content_length : max_temp_buf_size;
415-
char * temp_buf = (char*)malloc(temp_buf_size + 1 OS_DBG_FILEPOS); // new char[temp_buf_size + 1];
416-
for(int cur_len; (cur_len = FCGX_GetStr(temp_buf, temp_buf_size, request->in)) > 0;){
417-
POSTParser.AcceptSomeData(temp_buf, cur_len);
418-
}
419-
free(temp_buf); // delete [] temp_buf;
420-
temp_buf = NULL;
410+
char * temp_buf = NULL;
411+
try{
412+
// dolog("begin multipart_form_data");
413+
POSTParser.SetTempDirForFileUpload("/tmp");
414+
// POSTParser.SetMaxCollectedDataLength(20*1024);
415+
POSTParser.SetContentType(content_type.toChar());
416+
417+
int max_temp_buf_size = (int)(1024*1024*0.1);
418+
int temp_buf_size = content_length < max_temp_buf_size ? content_length : max_temp_buf_size;
419+
temp_buf = (char*)malloc(temp_buf_size + 1 OS_DBG_FILEPOS); // new char[temp_buf_size + 1];
420+
for(int cur_len; (cur_len = FCGX_GetStr(temp_buf, temp_buf_size, request->in)) > 0;){
421+
POSTParser.AcceptSomeData(temp_buf, cur_len);
422+
}
423+
free(temp_buf); // delete [] temp_buf;
424+
temp_buf = NULL;
421425

422-
// POSTParser.SetExternalDataBuffer(buf, len);
423-
POSTParser.FinishData();
424-
425-
std::map<std::string, MPFD::Field *> fields = POSTParser.GetFieldsMap();
426-
// FCGX_FPrintF(request->out, "Have %d fields<p>\n", fields.size());
427-
428-
std::map<std::string, MPFD::Field *>::iterator it;
429-
for(it = fields.begin(); it != fields.end(); it++){
430-
MPFD::Field * field = fields[it->first];
431-
if(field->GetType() == MPFD::Field::TextType){
432-
getGlobal("_POST");
433-
pushString(field->GetTextTypeContent().c_str());
434-
setSmartProperty(it->first.c_str());
435-
}else{
436-
getGlobal("_FILES");
437-
newObject();
438-
{
439-
pushStackValue();
440-
pushString(field->GetFileName().c_str());
441-
setProperty("name");
426+
// POSTParser.SetExternalDataBuffer(buf, len);
427+
POSTParser.FinishData();
428+
}catch(MPFD::Exception& e){
429+
is_valid_headers = false;
430+
free(temp_buf);
431+
#if defined _MSC_VER && 1
432+
fprintf(stderr, "error post data: %s\n", e.GetError().c_str());
433+
#endif
434+
}
435+
if(is_valid_headers){
436+
std::map<std::string, MPFD::Field *> fields = POSTParser.GetFieldsMap();
437+
// FCGX_FPrintF(request->out, "Have %d fields<p>\n", fields.size());
438+
439+
std::map<std::string, MPFD::Field *>::iterator it;
440+
for(it = fields.begin(); it != fields.end(); it++){
441+
MPFD::Field * field = fields[it->first];
442+
if(field->GetType() == MPFD::Field::TextType){
443+
getGlobal("_POST");
444+
pushString(field->GetTextTypeContent().c_str());
445+
setSmartProperty(it->first.c_str());
446+
}else{
447+
getGlobal("_FILES");
448+
newObject();
449+
{
450+
pushStackValue();
451+
pushString(field->GetFileName().c_str());
452+
setProperty("name");
442453

443-
pushStackValue();
444-
pushString(field->GetFileMimeType().c_str());
445-
setProperty("type");
454+
pushStackValue();
455+
pushString(field->GetFileMimeType().c_str());
456+
setProperty("type");
446457

447-
pushStackValue();
448-
pushString(field->GetTempFileNameEx().c_str());
449-
setProperty("temp");
458+
pushStackValue();
459+
pushString(field->GetTempFileNameEx().c_str());
460+
setProperty("temp");
450461

451-
pushStackValue();
452-
pushNumber(getFileSize(field->GetTempFileNameEx().c_str()));
453-
setProperty("size");
462+
pushStackValue();
463+
pushNumber(getFileSize(field->GetTempFileNameEx().c_str()));
464+
setProperty("size");
465+
}
466+
setSmartProperty(it->first.c_str());
454467
}
455-
setSmartProperty(it->first.c_str());
456468
}
469+
// dolog("end multipart_form_data");
457470
}
458-
// dolog("end multipart_form_data");
459471
}else if(content_length > 0 && strncmp(content_type.toChar(), form_urlencoded, form_urlencoded_len) == 0){
460472
// dolog("begin form_urlencoded");
461473
Core::Buffer buf(this);
@@ -550,7 +562,7 @@ class FCGX_OS: public OS
550562
OS_OPENSOURCE
551563
"</center></body></html>";
552564

553-
if(script_filename.isEmpty()){
565+
if(script_filename.isEmpty() || !is_valid_headers){
554566
if(!headers_sent){
555567
headers_sent = true;
556568
FCGX_PutS(just_ready, request->out);

0 commit comments

Comments
 (0)