Merge pull request #46 from kolbyjack/master

Also return error for bad requests starting with M or C

http_parser.c

@@ -632,6 +632,8 @@ size_t http_parser_execute (http_parser *parser,
             parser->method = HTTP_CHECKOUT;
           } else if (index == 2  && ch == 'P') {
             parser->method = HTTP_COPY;
+          } else {
+            goto error;
           }
         } else if (parser->method == HTTP_MKCOL) {
           if (index == 1 && ch == 'O') {
@@ -642,6 +644,8 @@ size_t http_parser_execute (http_parser *parser,
             parser->method = HTTP_MSEARCH;
           } else if (index == 2 && ch == 'A') {
             parser->method = HTTP_MKACTIVITY;
+          } else {
+            goto error;
           }
         } else if (index == 1 && parser->method == HTTP_POST && ch == 'R') {
           parser->method = HTTP_PROPFIND; /* or HTTP_PROPPATCH */

test.c

@@ -1937,6 +1937,16 @@ main (void)
     test_simple(buf, 1);
   }
 
+  static const char *bad_methods[] = {
+      "C******",
+      "M****",
+      0 };
+  for (this_method = bad_methods; *this_method; this_method++) {
+    char buf[200];
+    sprintf(buf, "%s / HTTP/1.1\r\n\r\n", *this_method);
+    test_simple(buf, 0);
+  }
+
   const char *dumbfuck2 =
     "GET / HTTP/1.1\r\n"
     "X-SSL-Bullshit:   -----BEGIN CERTIFICATE-----\r\n"