httrack

rms/httrack

Fork 0

mirror of https://github.com/xroche/httrack.git synced 2026-07-08 18:06:31 +03:00

Author	SHA1	Message	Date
Xavier Roche	fd2252dc8c	Fix remote stack overflow and uninit read in Content-Type/-Encoding parsing (#506 ) treathead() parsed the Content-Type and Content-Encoding response-header values with a width-less sscanf("%s") into a 1100-byte stack scratch, bounds-checking the result only after the copy. The receive path in back_wait hands treathead a line buffer of up to 2000 bytes (htsback.c rcvd[2048], binput cap 2000), so a hostile server sending a header value longer than 1099 non-whitespace bytes overflowed the stack. Bound both scans to the buffer (%1099s), matching the existing %31s/%255s idiom in the request-line parsers. The Content-Encoding branch also ignored the sscanf return, so an empty value (e.g. "Content-Encoding:") left tempo uninitialized and then ran strlen() over it: an uninitialized read that can also over-read past the buffer. The Content-Type branch already guarded this; mirror it. Found via the P3-3 static-analysis baseline. New -#test=headerlong plus empty-value cases in 01_engine-header.test build the hostile inputs in the handler (the CLI caps argument length); they abort on the pre-fix binary under ASan (overflow) and MSan (uninitialized read). Signed-off-by: Xavier Roche <roche@httrack.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-08 08:53:57 +02:00

Author

SHA1

Message

Date

Xavier Roche

fd2252dc8c

Fix remote stack overflow and uninit read in Content-Type/-Encoding parsing (#506 )

treathead() parsed the Content-Type and Content-Encoding response-header
values with a width-less sscanf("%s") into a 1100-byte stack scratch,
bounds-checking the result only after the copy. The receive path in
back_wait hands treathead a line buffer of up to 2000 bytes (htsback.c
rcvd[2048], binput cap 2000), so a hostile server sending a header value
longer than 1099 non-whitespace bytes overflowed the stack. Bound both
scans to the buffer (%1099s), matching the existing %31s/%255s idiom in
the request-line parsers.

The Content-Encoding branch also ignored the sscanf return, so an empty
value (e.g. "Content-Encoding:") left tempo uninitialized and then ran
strlen() over it: an uninitialized read that can also over-read past the
buffer. The Content-Type branch already guarded this; mirror it.

Found via the P3-3 static-analysis baseline. New -#test=headerlong plus
empty-value cases in 01_engine-header.test build the hostile inputs in
the handler (the CLI caps argument length); they abort on the pre-fix
binary under ASan (overflow) and MSan (uninitialized read).

Signed-off-by: Xavier Roche <roche@httrack.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

2026-07-08 08:53:57 +02:00

Compare commits

1 Commits

fix-header ... master

Diff Content Not Available

Compare commits

1 Commits fix-header ... master

Diff Content Not Available

1 Commits

fix-header ... master