walkero
/
nghttp2
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

Fixed duplicate name/value header block detection

This commit is contained in:
Tatsuhiro Tsujikawa 2012-03-29 23:50:08 +09:00
parent dea8a484b2
commit 67e83e09a6
1 changed files with 15 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
lib/spdylay_frame.c
View File

@ -218,16 +218,21 @@ int spdylay_frame_unpack_nv_check_name(uint8_t *buf, size_t buflen,
len = spdylay_frame_get_nv_len(in, len_size); len = spdylay_frame_get_nv_len(in, len_size);
in += len_size+len; in += len_size+len;
} }
qsort(buf, n, sizeof(uint8_t*), if(n > 0) {
len_size == 2 ? uint32_t len1, len2;
spdylay_length_prefix_str_compar2 : spdylay_length_prefix_str_compar4); qsort(buf, n, sizeof(uint8_t*),
index = (const uint8_t**)buf; len_size == 2 ?
for(i = 1; i < n; ++i) { spdylay_length_prefix_str_compar2 :
uint32_t len1 = spdylay_frame_get_nv_len(*(index+i-1), len_size); spdylay_length_prefix_str_compar4);
uint32_t len2 = spdylay_frame_get_nv_len(*(index+i), len_size); index = (const uint8_t**)buf;
if(len1 == len2 && memcmp(*(index+i-1)+len_size, *(index+i)+len_size, len1 = spdylay_frame_get_nv_len(*index, len_size);
len_size) == 0) { for(i = 1; i < n; ++i) {
return SPDYLAY_ERR_INVALID_HEADER_BLOCK; len2 = spdylay_frame_get_nv_len(*(index+i), len_size);
if(len1 == len2 && memcmp(*(index+i-1)+len_size, *(index+i)+len_size,
len1) == 0) {
return SPDYLAY_ERR_INVALID_HEADER_BLOCK;
}
len1 = len2;
} }
} }
return 0; return 0;