fix use-after-realloc issue with the request url

diff --git a/client.c b/client.c
index 28c8f760be9a14a0d9ee5572796a32b769f8862d..2fdc1b21bc24820506f1742915f63c2d13999e59 100644 (file)
--- a/client.c
+++ b/client.c
@@ -142,9 +142,9 @@ static int client_parse_request(struct client *cl, char *data)
        if (!type || !path || !version)
                return CLIENT_STATE_DONE;
 
-       memset(&cl->request, 0, sizeof(cl->request));
-       req->url = path;
+       blobmsg_add_string(&cl->hdr, "URL", path);
 
+       memset(&cl->request, 0, sizeof(cl->request));
        h_method = find_idx(http_methods, ARRAY_SIZE(http_methods), type);
        h_version = find_idx(http_versions, ARRAY_SIZE(http_versions), version);
        if (h_method < 0 || h_version < 0) {
@@ -168,9 +168,8 @@ static bool client_init_cb(struct client *cl, char *buf, int len)
 
        *newline = 0;
        blob_buf_init(&cl->hdr, 0);
-       blobmsg_add_string(&cl->hdr, "REQUEST", buf);
+       cl->state = client_parse_request(cl, buf);
        ustream_consume(cl->us, newline + 2 - buf);
-       cl->state = client_parse_request(cl, (char *) blobmsg_data(blob_data(cl->hdr.head)));
        if (cl->state == CLIENT_STATE_DONE)
                uh_header_error(cl, 400, "Bad Request");
 

diff --git a/file.c b/file.c
index 679755d9754313813808e7bee059a3086399081a..e95a1650a74ddbbd861e4e326e55df449335d0fe 100644 (file)
--- a/file.c
+++ b/file.c
@@ -685,7 +685,7 @@ static bool __handle_file_request(struct client *cl, const char *url)
 void uh_handle_request(struct client *cl)
 {
        struct dispatch_handler *d;
-       const char *url = cl->request.url;
+       const char *url = blobmsg_data(blob_data(cl->hdr.head));;
 
        d = dispatch_find(url, NULL);
        if (d) {
@@ -697,5 +697,5 @@ void uh_handle_request(struct client *cl)
            __handle_file_request(cl, conf.error_handler))
                return;
 
-       uh_client_error(cl, 404, "Not Found", "The requested URL %s was not found on this server.", cl->request.url);
+       uh_client_error(cl, 404, "Not Found", "The requested URL %s was not found on this server.", url);
 }

diff --git a/proc.c b/proc.c
index 351b473eff1b1fd4e7168a9a08d7e08cddeb46c4..425576e2886723dd290fcd8883c96333793392ec 100644 (file)
--- a/proc.c
+++ b/proc.c
@@ -123,9 +123,11 @@ struct env_var *uh_get_process_vars(struct client *cl, struct path_info *pi)
        struct blob_attr *data = cl->hdr.head;
        struct env_var *vars = (void *) uh_buf;
        struct blob_attr *tb[__HDR_MAX];
+       const char *url;
        int len;
        int i;
 
+       url = blobmsg_data(blob_data(cl->hdr.head));
        len = ARRAY_SIZE(proc_header_env);
        len += ARRAY_SIZE(extra_vars);
        len *= sizeof(struct env_var);
@@ -136,7 +138,7 @@ struct env_var *uh_get_process_vars(struct client *cl, struct path_info *pi)
        extra_vars[VAR_SCRIPT_FILE].value = pi->phys;
        extra_vars[VAR_DOCROOT].value = pi->root;
        extra_vars[VAR_QUERY].value = pi->query ? pi->query : "";
-       extra_vars[VAR_REQUEST].value = req->url;
+       extra_vars[VAR_REQUEST].value = url;
        extra_vars[VAR_PROTO].value = http_versions[req->version];
        extra_vars[VAR_METHOD].value = http_methods[req->method];
        extra_vars[VAR_PATH_INFO].value = pi->info;

diff --git a/uhttpd.h b/uhttpd.h
index b2404f400efa5b238da4fd35e3d47dfffcc2b167..5ec0f00a9c43572588a934b2d2857253f430819a 100644 (file)
--- a/uhttpd.h
+++ b/uhttpd.h
@@ -82,7 +82,6 @@ struct http_request {
        int content_length;
        bool expect_cont;
        uint8_t transfer_chunked;
-       const char *url;
        const struct auth_realm *realm;
 };