sock: avoid endless loop in sock_recv_chunk_header (2)

This commit is contained in:
2026-06-03 00:53:25 +02:00
parent c6bc32fab2
commit 7ede369470
2 changed files with 10 additions and 13 deletions
+10 -12
View File
@@ -414,31 +414,29 @@ long sock_recv_chunk_header(sock *s) {
return len; return len;
} }
long ret; long ret1, ret2 = -1;
size_t len = 0; size_t len = 0;
char buf[20]; char buf[20], *buf_ptr = buf;
do { do {
if ((ret = sock_recv(s, buf, sizeof(buf) - 1, MSG_PEEK)) <= 0) { if ((ret1 = sock_recv(s, buf_ptr, sizeof(buf) - 1 - (buf_ptr - buf), MSG_PEEK)) <= 0) {
if (errno == EINTR || errno == EAGAIN) { if (errno == EINTR || errno == EAGAIN) {
errno = 0; errno = 0;
continue; continue;
} else { } else {
return -1; return -1;
} }
} else if (ret < 2 || ret >= sizeof(buf)) {
return -1;
} }
buf[ret] = 0; buf_ptr[ret1] = 0;
if ((ret = parse_chunk_header(buf, ret, &len)) == -1 && errno == EPROTO) if ((ret2 = parse_chunk_header(buf, (buf_ptr - buf) + ret1, &len)) == -1 && errno == EPROTO)
return -1; return -1;
} while (ret < 0); if (sock_recv_x(s, buf_ptr, ret1, 0) == -1)
return -1;
buf_ptr += ret1;
} while (ret2 < 0);
if (sock_recv_x(s, buf, len, 0) == -1) return ret2;
return -1;
return ret;
} }
int sock_send_chunk_header(sock *s, unsigned long size) { int sock_send_chunk_header(sock *s, unsigned long size) {
-1
View File
@@ -30,7 +30,6 @@ void fastcgi_frame_handler_func(fastcgi_ctx_t *ctx) {
default: default:
// end of request received // end of request received
write(ctx->cnx.fd_out, &val, sizeof(val)); write(ctx->cnx.fd_out, &val, sizeof(val));
write(ctx->cnx.fd_out, "\r\n", 2);
fastcgi_close(ctx); fastcgi_close(ctx);
} }
} }