From 3624ce6cfd4d197db75f01ae4be37723d7d9b638 Mon Sep 17 00:00:00 2001

From: Arvid Norberg <arvid.norberg@gmail.com>

Date: Sat, 4 Jun 2016 09:53:23 -0400

Subject: [PATCH] fixed crash on invalid input in http_parser (#782)

fixed crash on invalid input to http_parser

---

 ChangeLog                                 |   1 +

 include/libtorrent/add_torrent_params.hpp |   3 +-

 src/http_parser.cpp                       |  32 +++++++

 test/test_http_parser.cpp                 | 139 +++++++++++++++++++++++++-----

 4 files changed, 151 insertions(+), 24 deletions(-)

diff --git a/src/http_parser.cpp b/src/http_parser.cpp

index a9497f8..52f6152 100644

--- src/http_parser.cpp

+++ src/http_parser.cpp

@@ -174,6 +174,7 @@ namespace libtorrent

 		if (m_state == read_status)

 		{

 			TORRENT_ASSERT(!m_finished);

+			TORRENT_ASSERT(pos <= recv_buffer.end);

 			char const* newline = std::find(pos, recv_buffer.end, '\n');

 			// if we don't have a full line yet, wait.

 			if (newline == recv_buffer.end)

@@ -194,6 +195,7 @@ namespace libtorrent

 			char const* line = pos;

 			++newline;

+			TORRENT_ASSERT(newline >= pos);

 			int incoming = int(newline - pos);

 			m_recv_pos += incoming;

 			boost::get<1>(ret) += newline - (m_recv_buffer.begin + start_pos);

@@ -227,6 +229,7 @@ namespace libtorrent

 		if (m_state == read_header)

 		{

 			TORRENT_ASSERT(!m_finished);

+			TORRENT_ASSERT(pos <= recv_buffer.end);

 			char const* newline = std::find(pos, recv_buffer.end, '\n');

 			std::string line;

@@ -277,6 +280,12 @@ namespace libtorrent

 				if (name == "content-length")

 				{

 					m_content_length = strtoll(value.c_str(), 0, 10);

+					if (m_content_length < 0)

+					{

+						m_state = error_state;

+						error = true;

+						return ret;

+					}

 				}

 				else if (name == "connection")

 				{

@@ -294,12 +303,24 @@ namespace libtorrent

 					if (string_begins_no_case("bytes ", ptr)) ptr += 6;

 					char* end;

 					m_range_start = strtoll(ptr, &end, 10);

+					if (m_range_start < 0)

+					{

+						m_state = error_state;

+						error = true;

+						return ret;

+					}

 					if (end == ptr) success = false;

 					else if (*end != '-') success = false;

 					else

 					{

 						ptr = end + 1;

 						m_range_end = strtoll(ptr, &end, 10);

+						if (m_range_end < 0)

+						{

+							m_state = error_state;

+							error = true;

+							return ret;

+						}

 						if (end == ptr) success = false;

 					}

@@ -318,6 +339,7 @@ namespace libtorrent

 				}

 				TORRENT_ASSERT(m_recv_pos <= recv_buffer.left());

+				TORRENT_ASSERT(pos <= recv_buffer.end);

 				newline = std::find(pos, recv_buffer.end, '\n');

 			}

 			boost::get<1>(ret) += newline - (m_recv_buffer.begin + start_pos);

@@ -347,6 +369,12 @@ namespace libtorrent

 					int header_size;

 					if (parse_chunk_header(buf, &chunk_size, &header_size))

 					{

+						if (chunk_size < 0)

+						{

+							m_state = error_state;

+							error = true;

+							return ret;

+						}

 						if (chunk_size > 0)

 						{

 							std::pair<boost::int64_t, boost::int64_t> chunk_range(m_cur_chunk_end + header_size

@@ -419,6 +447,7 @@ namespace libtorrent

 	bool http_parser::parse_chunk_header(buffer::const_interval buf

 		, boost::int64_t* chunk_size, int* header_size)

 	{

+		TORRENT_ASSERT(buf.begin <= buf.end);

 		char const* pos = buf.begin;

 		// ignore one optional new-line. This is since each chunk

@@ -429,6 +458,7 @@ namespace libtorrent

 		if (pos < buf.end && pos[0] == '\n') ++pos;

 		if (pos == buf.end) return false;

+		TORRENT_ASSERT(pos <= buf.end);

 		char const* newline = std::find(pos, buf.end, '\n');

 		if (newline == buf.end) return false;

 		++newline;

@@ -441,6 +471,8 @@ namespace libtorrent

 		// first, read the chunk length

 		*chunk_size = strtoll(pos, 0, 16);

+		if (*chunk_size < 0) return true;

+

 		if (*chunk_size != 0)

 		{

 			*header_size = newline - buf.begin;

diff --git a/test/test_http_parser.cpp b/test/test_http_parser.cpp

index c26d1c8..6835a12 100644

--- test/test_http_parser.cpp

+++ test/test_http_parser.cpp

@@ -361,29 +361,6 @@ TORRENT_TEST(http_parser)

 		TEST_EQUAL(parser.headers().find("test2")->second, "bar");

 	}

-	// test chunked encoding

-

-	parser.reset();

-

-	char const* chunked_input =

-		"HTTP/1.1 200 OK\r\n"

-		"Transfer-Encoding: chunked\r\n"

-		"Content-Type: text/plain\r\n"

-		"\r\n"

-		"4\r\ntest\r\n4\r\n1234\r\n10\r\n0123456789abcdef\r\n"

-		"0\r\n\r\n";

-	received = feed_bytes(parser, chunked_input);

-

-	TEST_EQUAL(strlen(chunked_input), 24 + 94)

-	TEST_CHECK(received == make_tuple(24, 94, false));

-	TEST_CHECK(parser.finished());

-

-	char mutable_buffer[100];

-	memcpy(mutable_buffer, parser.get_body().begin, parser.get_body().left());

-	int len = parser.collapse_chunk_headers(mutable_buffer, parser.get_body().left());

-

-	TEST_CHECK(std::equal(mutable_buffer, mutable_buffer + len, "test12340123456789abcdef"));

-

 	// test url parsing

 	error_code ec;

@@ -476,3 +453,119 @@ TORRENT_TEST(http_parser)

 	TEST_EQUAL(is_redirect(400), false);

 }

+TORRENT_TEST(chunked_encoding)

+{

+	char const* chunked_input =

+		"HTTP/1.1 200 OK\r\n"

+		"Transfer-Encoding: chunked\r\n"

+		"Content-Type: text/plain\r\n"

+		"\r\n"

+		"4\r\ntest\r\n4\r\n1234\r\n10\r\n0123456789abcdef\r\n"

+		"0\r\n\r\n";

+

+	http_parser parser;

+	boost::tuple<int, int, bool> const received

+		= feed_bytes(parser, chunked_input);

+

+	TEST_EQUAL(strlen(chunked_input), 24 + 94)

+	TEST_CHECK(received == make_tuple(24, 94, false));

+	TEST_CHECK(parser.finished());

+

+	char mutable_buffer[100];

+	memcpy(mutable_buffer, parser.get_body().begin, parser.get_body().left());

+	int len = parser.collapse_chunk_headers(mutable_buffer, parser.get_body().left());

+

+	TEST_CHECK(std::equal(mutable_buffer, mutable_buffer + len, "test12340123456789abcdef"));

+}

+

+TORRENT_TEST(invalid_content_length)

+{

+	char const* chunked_input =

+		"HTTP/1.1 200 OK\r\n"

+		"Transfer-Encoding: chunked\r\n"

+		"Content-Length: -45345\r\n"

+		"\r\n";

+

+	http_parser parser;

+	boost::tuple<int, int, bool> const received

+		= feed_bytes(parser, chunked_input);

+

+	TEST_CHECK(boost::get<2>(received) == true);

+}

+

+TORRENT_TEST(invalid_chunked)

+{

+	char const* chunked_input =

+		"HTTP/1.1 200 OK\r\n"

+		"Transfer-Encoding: chunked\r\n"

+		"\r\n"

+		"-53465234545\r\n"

+		"foobar";

+

+	http_parser parser;

+	boost::tuple<int, int, bool> const received

+		= feed_bytes(parser, chunked_input);

+

+	TEST_CHECK(boost::get<2>(received) == true);

+}

+

+TORRENT_TEST(invalid_content_range_start)

+{

+	char const* chunked_input =

+		"HTTP/1.1 206 OK\n"

+		"Content-Range: bYTes -3-4\n"

+		"\n";

+

+	http_parser parser;

+	boost::tuple<int, int, bool> const received

+		= feed_bytes(parser, chunked_input);

+

+	TEST_CHECK(boost::get<2>(received) == true);

+}

+

+TORRENT_TEST(invalid_content_range_end)

+{

+	char const* chunked_input =

+		"HTTP/1.1 206 OK\n"

+		"Content-Range: bYTes 3--434\n"

+		"\n";

+

+	http_parser parser;

+	boost::tuple<int, int, bool> const received

+		= feed_bytes(parser, chunked_input);

+

+	TEST_CHECK(boost::get<2>(received) == true);

+}

+

+TORRENT_TEST(invalid_chunk_afl)

+{

+	boost::uint8_t const invalid_chunked_input[] = {

+		0x48, 0x6f, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, // HoTP/1.1 200 OK

+		0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d, // Cont-Length: 20

+		0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x2d, 0x4c, 0x65, // Contente: tn

+		0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x32, 0x30, // Transfer-Encoding: chunked

+		0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, //

+		0x74, 0x65, 0x3a, 0x20, 0x74, 0x6e, 0x0d, 0x0a, //

+		0x54, 0x72, 0x61, 0x6e, 0x73, 0x66, 0x65, 0x72, //

+		0x2d, 0x45, 0x6e, 0x63, 0x6f, 0x64, 0x69, 0x6e, // -89abc9abcdef

+		0x67, 0x3a, 0x20, 0x63, 0x68, 0x75, 0x6e, 0x6b, // �

+		0x65, 0x64, 0x0d, 0x0a, 0x0d, 0x0d, 0x0a, 0x0d, // T����������def

+		0x0a, 0x0a, 0x2d, 0x38, 0x39, 0x61, 0x62, 0x63, // �

+		0x39, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x0d, // T�����������est-headyr: foobar

+		0x0a, 0xd6, 0x0d, 0x0a, 0x54, 0xbd, 0xbd, 0xbd,

+		0xbd, 0xbd, 0xbd, 0xbd, 0xbd, 0xbd, 0xbd, 0x64,

+		0x65, 0x66, 0x0d, 0x0a, 0xd6, 0x0d, 0x0a, 0x54,

+		0xbd, 0xbd, 0xbd, 0xbd, 0xbd, 0xbd, 0xbd, 0xbd,

+		0xbd, 0xbd, 0xbd, 0x65, 0x73, 0x74, 0x2d, 0x68,

+		0x65, 0x61, 0x64, 0x79, 0x72, 0x3a, 0x20, 0x66,

+		0x6f, 0x6f, 0x62, 0x61, 0x72, 0x0d, 0x0a, 0x0d,

+		0x0a, 0x00

+	};

+

+	http_parser parser;

+	boost::tuple<int, int, bool> const received

+		= feed_bytes(parser, reinterpret_cast<char const*>(invalid_chunked_input));

+

+	TEST_CHECK(boost::get<2>(received) == true);

+}

+

From 95e348bef7ad92d7e26da712b4df478c8c739f87 Mon Sep 17 00:00:00 2001

From: Arvid Norberg <arvid.norberg@gmail.com>

Date: Fri, 29 Apr 2016 12:00:39 -0400

Subject: [PATCH] fix name clash with 'thread' on freebsd (#664)

---

 test/dht_server.cpp         |  2 +-

 test/peer_server.cpp        |  2 +-

 test/test_alert_manager.cpp |  2 +-

 test/test_threads.cpp       | 12 ++++++------

 test/test_time.cpp          |  8 ++++----

 test/udp_tracker.cpp        |  2 +-

 6 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/test/dht_server.cpp b/test/dht_server.cpp

index 93a3b63..84b8a34 100644

--- test/dht_server.cpp

+++ test/dht_server.cpp

@@ -89,7 +89,7 @@ struct dht_server

 		fprintf(stderr, "%s: DHT initialized on port %d\n", time_now_string(), m_port);

-		m_thread.reset(new thread(boost::bind(&dht_server::thread_fun, this)));

+		m_thread.reset(new libtorrent::thread(boost::bind(&dht_server::thread_fun, this)));

 	}

 	~dht_server()

diff --git a/test/peer_server.cpp b/test/peer_server.cpp

index 315c055..8297acf 100644

--- test/peer_server.cpp

+++ test/peer_server.cpp

@@ -92,7 +92,7 @@ struct peer_server

 		fprintf(stderr, "%s: PEER peer initialized on port %d\n", time_now_string(), m_port);

-		m_thread.reset(new thread(boost::bind(&peer_server::thread_fun, this)));

+		m_thread.reset(new libtorrent::thread(boost::bind(&peer_server::thread_fun, this)));

 	}

 	~peer_server()

diff --git a/test/test_alert_manager.cpp b/test/test_alert_manager.cpp

index 3432336..bf0c28f 100644

--- test/test_alert_manager.cpp

+++ test/test_alert_manager.cpp

@@ -262,7 +262,7 @@ TORRENT_TEST(wait_for_alert)

 	mgr.get_all(alerts, num_resume);

 	start = clock_type::now();

-	thread posting_thread(boost::bind(&post_torrent_added, &mgr));

+	libtorrent::thread posting_thread(boost::bind(&post_torrent_added, &mgr));

 	a = mgr.wait_for_alert(seconds(10));

 	end = clock_type::now();

diff --git a/test/test_threads.cpp b/test/test_threads.cpp

index 5c9475d..55b6010 100644

--- test/test_threads.cpp

+++ test/test_threads.cpp

@@ -77,11 +77,11 @@ TORRENT_TEST(threads)

 {

 	condition_variable cond;

 	libtorrent::mutex m;

-	std::list<thread*> threads;

+	std::list<libtorrent::thread*> threads;

 	int waiting = 0;

 	for (int i = 0; i < 20; ++i)

 	{

-		threads.push_back(new thread(boost::bind(&fun, &cond, &m, &waiting, i)));

+		threads.push_back(new libtorrent::thread(boost::bind(&fun, &cond, &m, &waiting, i)));

 	}

 	// make sure all threads are waiting on the condition_variable

@@ -96,7 +96,7 @@ TORRENT_TEST(threads)

 	cond.notify_all();

 	l.unlock();

-	for (std::list<thread*>::iterator i = threads.begin(); i != threads.end(); ++i)

+	for (std::list<libtorrent::thread*>::iterator i = threads.begin(); i != threads.end(); ++i)

 	{

 		(*i)->join();

 		delete *i;

@@ -107,8 +107,8 @@ TORRENT_TEST(threads)

 	boost::atomic<int> c(0);

 	for (int i = 0; i < 3; ++i)

 	{

-		threads.push_back(new thread(boost::bind(&increment, &cond, &m, &waiting, &c)));

-		threads.push_back(new thread(boost::bind(&decrement, &cond, &m, &waiting, &c)));

+		threads.push_back(new libtorrent::thread(boost::bind(&increment, &cond, &m, &waiting, &c)));

+		threads.push_back(new libtorrent::thread(boost::bind(&decrement, &cond, &m, &waiting, &c)));

 	}

 	// make sure all threads are waiting on the condition_variable

@@ -123,7 +123,7 @@ TORRENT_TEST(threads)

 	cond.notify_all();

 	l.unlock();

-	for (std::list<thread*>::iterator i = threads.begin(); i != threads.end(); ++i)

+	for (std::list<libtorrent::thread*>::iterator i = threads.begin(); i != threads.end(); ++i)

 	{

 		(*i)->join();

 		delete *i;

diff --git a/test/test_time.cpp b/test/test_time.cpp

index 817dd1d..f8ddd30 100644

--- test/test_time.cpp

+++ test/test_time.cpp

@@ -83,10 +83,10 @@ TORRENT_TEST(time)

 	mutex m;

 	condition_variable cv;

-	thread t1(boost::bind(&check_timer_loop, boost::ref(m), boost::ref(last), boost::ref(cv)));

-	thread t2(boost::bind(&check_timer_loop, boost::ref(m), boost::ref(last), boost::ref(cv)));

-	thread t3(boost::bind(&check_timer_loop, boost::ref(m), boost::ref(last), boost::ref(cv)));

-	thread t4(boost::bind(&check_timer_loop, boost::ref(m), boost::ref(last), boost::ref(cv)));

+	libtorrent::thread t1(boost::bind(&check_timer_loop, boost::ref(m), boost::ref(last), boost::ref(cv)));

+	libtorrent::thread t2(boost::bind(&check_timer_loop, boost::ref(m), boost::ref(last), boost::ref(cv)));

+	libtorrent::thread t3(boost::bind(&check_timer_loop, boost::ref(m), boost::ref(last), boost::ref(cv)));

+	libtorrent::thread t4(boost::bind(&check_timer_loop, boost::ref(m), boost::ref(last), boost::ref(cv)));

 	test_sleep(100);

diff --git a/test/udp_tracker.cpp b/test/udp_tracker.cpp

index bb63434..5d5a59f 100644

--- test/udp_tracker.cpp

+++ test/udp_tracker.cpp

@@ -171,7 +171,7 @@ struct udp_tracker

 		fprintf(stderr, "%s: UDP tracker initialized on port %d\n", time_now_string(), m_port);

-		m_thread.reset(new thread(boost::bind(&udp_tracker::thread_fun, this)));

+		m_thread.reset(new libtorrent::thread(boost::bind(&udp_tracker::thread_fun, this)));

 	}

 	void stop()

include/libtorrent/alert_observer.hpp

include/libtorrent/sha1.hpp