Commit b292c35f by Edward Thomson

http_parser: cast pointer arithmetic safely

parent e48dbdf9
...@@ -1992,6 +1992,9 @@ http_parse_host(const char * buf, struct http_parser_url *u, int found_at) { ...@@ -1992,6 +1992,9 @@ http_parse_host(const char * buf, struct http_parser_url *u, int found_at) {
const char *p; const char *p;
size_t buflen = u->field_data[UF_HOST].off + u->field_data[UF_HOST].len; size_t buflen = u->field_data[UF_HOST].off + u->field_data[UF_HOST].len;
if (buflen > UINT16_MAX)
return 1;
u->field_data[UF_HOST].len = 0; u->field_data[UF_HOST].len = 0;
s = found_at ? s_http_userinfo_start : s_http_host_start; s = found_at ? s_http_userinfo_start : s_http_host_start;
...@@ -2006,21 +2009,21 @@ http_parse_host(const char * buf, struct http_parser_url *u, int found_at) { ...@@ -2006,21 +2009,21 @@ http_parse_host(const char * buf, struct http_parser_url *u, int found_at) {
switch(new_s) { switch(new_s) {
case s_http_host: case s_http_host:
if (s != s_http_host) { if (s != s_http_host) {
u->field_data[UF_HOST].off = p - buf; u->field_data[UF_HOST].off = (uint16_t)(p - buf);
} }
u->field_data[UF_HOST].len++; u->field_data[UF_HOST].len++;
break; break;
case s_http_host_v6: case s_http_host_v6:
if (s != s_http_host_v6) { if (s != s_http_host_v6) {
u->field_data[UF_HOST].off = p - buf; u->field_data[UF_HOST].off = (uint16_t)(p - buf);
} }
u->field_data[UF_HOST].len++; u->field_data[UF_HOST].len++;
break; break;
case s_http_host_port: case s_http_host_port:
if (s != s_http_host_port) { if (s != s_http_host_port) {
u->field_data[UF_PORT].off = p - buf; u->field_data[UF_PORT].off = (uint16_t)(p - buf);
u->field_data[UF_PORT].len = 0; u->field_data[UF_PORT].len = 0;
u->field_set |= (1 << UF_PORT); u->field_set |= (1 << UF_PORT);
} }
...@@ -2029,7 +2032,7 @@ http_parse_host(const char * buf, struct http_parser_url *u, int found_at) { ...@@ -2029,7 +2032,7 @@ http_parse_host(const char * buf, struct http_parser_url *u, int found_at) {
case s_http_userinfo: case s_http_userinfo:
if (s != s_http_userinfo) { if (s != s_http_userinfo) {
u->field_data[UF_USERINFO].off = p - buf ; u->field_data[UF_USERINFO].off = (uint16_t)(p - buf);
u->field_data[UF_USERINFO].len = 0; u->field_data[UF_USERINFO].len = 0;
u->field_set |= (1 << UF_USERINFO); u->field_set |= (1 << UF_USERINFO);
} }
...@@ -2066,6 +2069,9 @@ http_parser_parse_url(const char *buf, size_t buflen, int is_connect, ...@@ -2066,6 +2069,9 @@ http_parser_parse_url(const char *buf, size_t buflen, int is_connect,
enum http_parser_url_fields uf, old_uf; enum http_parser_url_fields uf, old_uf;
int found_at = 0; int found_at = 0;
if (buflen > UINT16_MAX)
return 1;
u->port = u->field_set = 0; u->port = u->field_set = 0;
s = is_connect ? s_req_server_start : s_req_spaces_before_url; s = is_connect ? s_req_server_start : s_req_spaces_before_url;
uf = old_uf = UF_MAX; uf = old_uf = UF_MAX;
...@@ -2121,7 +2127,7 @@ http_parser_parse_url(const char *buf, size_t buflen, int is_connect, ...@@ -2121,7 +2127,7 @@ http_parser_parse_url(const char *buf, size_t buflen, int is_connect,
continue; continue;
} }
u->field_data[uf].off = p - buf; u->field_data[uf].off = (uint16_t)(p - buf);
u->field_data[uf].len = 1; u->field_data[uf].len = 1;
u->field_set |= (1 << uf); u->field_set |= (1 << uf);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment