Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Off by one error in readAction. For example, let buffer = 'G' and length... #17

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

yeahwhatever
Copy link

... = 1, when readLine completes offset will also be 1. If we then try to append append(buffer, 2), we'll get a null char in our action, which will cause the SSL_write in HTTPSBridge.cpp to terminate early.

Tested on ubuntu 11.04 with linux 2.6.35.

…gth = 1, when readLine completes offset will also be 1. If we then try to append append(buffer, 2), we'll get a null char in our action, which will cause the SSL_write in HTTPSBridge.cpp to terminate early.


Tested on ubuntu 11.04 with linux 2.6.35.
@yeahwhatever
Copy link
Author

To make this a big easier to search for, this will fix 501 Unsupported Method 'G' in sslsniff.

@jethrogb
Copy link

jethrogb commented Nov 2, 2012

More robust fix for what is actually a buffer overrun:

--- sslsniff-0.8-ref/http/HttpHeaders.cpp  2010-03-10 15:06:26.000000000 -0800
+++ sslsniff-0.8/http/HttpHeaders.cpp      2012-11-01 20:26:48.935118000 -0700
@@ -57,7 +57,7 @@
     if (foundCr && foundLf) {
       foundCr = 0;
       foundLf = 0;
-      *offset = i;
+      *offset = i+1;
       return 1;
     }
   }
@@ -89,14 +89,14 @@
   int offset   = 0;
   int complete = readLine(buffer, &offset, length);

-  action.append(buffer, offset+1);
+  action.append(buffer, offset);

   if (complete) {
     parseAction();
     this->state = READING_KEY;    
   }

-  return offset + 1;
+  return offset;
 }

 int HttpHeaders::readValue(char *buffer, int offset, int length) {
@@ -115,7 +115,7 @@
     this->value.clear();
   }

-  return eolOffset + 1;
+  return eolOffset;
 }

 int HttpHeaders::readKey(char *buffer, int offset, int length) {

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants