From f6f436a12edf209be806be8833bced9419d985ca Mon Sep 17 00:00:00 2001 From: "Daniel Knoppel (Phusion)" Date: Mon, 18 May 2015 14:01:22 +0200 Subject: [PATCH] src: fix invalid memory access in http_parse_host http_parse_host() depends on `u->field_data[UF_HOST]`, but this if() allowed the method to be called if only `u->field_data[UF_SCHEMA]` was set, resulting in use of unintialized pointers. PR-URL: https://github.com/joyent/http-parser/pull/246 Reviewed-By: Fedor Indutny --- http_parser.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/http_parser.c b/http_parser.c index 0fa1c36..91f76f2 100644 --- a/http_parser.c +++ b/http_parser.c @@ -2232,6 +2232,7 @@ http_parse_host_char(enum http_host_state s, const char ch) { static int http_parse_host(const char * buf, struct http_parser_url *u, int found_at) { + assert(u->field_set & (1 << UF_HOST)); enum http_host_state s; const char *p; @@ -2376,7 +2377,12 @@ http_parser_parse_url(const char *buf, size_t buflen, int is_connect, /* host must be present if there is a schema */ /* parsing http:///toto will fail */ - if ((u->field_set & ((1 << UF_SCHEMA) | (1 << UF_HOST))) != 0) { + if ((u->field_set & (1 << UF_SCHEMA)) && + (u->field_set & (1 << UF_HOST)) == 0) { + return 1; + } + + if (u->field_set & (1 << UF_HOST)) { if (http_parse_host(buf, u, found_at) != 0) { return 1; }