may read beyond buffer (fixed)

splitice · splitice · commit fd9ce2a41fa5 · 2021-06-11T19:14:30.000+10:00
diff --git a/src/core/http_parse.cpp b/src/core/http_parse.cpp
@@ -202,7 +202,7 @@ static inline state_action http_read_requeststartmethod(int epfd, cache_connecti
 			RBUF_READMOVE(connection->input, n + 1);
 			return needs_more;
 		}
-		else if (n == 4 && (rbuf_cmpn(&connection->input, "BULK", 4) == 0 || rbuf_cmpn(&connection->input, "PURGE", 5) == 0)) {
+		else if ((n == 4 && rbuf_cmpn(&connection->input, "BULK", 4) == 0) || (n == 5 && rbuf_cmpn(&connection->input, "PURGE", 5) == 0)) {
 			//This is a BULK request
 			connection->type = REQUEST_HTTPPURGE;
 			assert(REQUEST_IS(connection->type, connection->type));

Original file line number	Diff line number	Diff line change
`@@ -202,7 +202,7 @@ static inline state_action http_read_requeststartmethod(int epfd, cache_connecti`
`202`	`202`	`RBUF_READMOVE(connection->input, n + 1);`
`203`	`203`	`return needs_more;`
`204`	`204`	`}`
`205`		`- else if (n == 4 && (rbuf_cmpn(&connection->input, "BULK", 4) == 0 \|\| rbuf_cmpn(&connection->input, "PURGE", 5) == 0)) {`
	`205`	`+ else if ((n == 4 && rbuf_cmpn(&connection->input, "BULK", 4) == 0) \|\| (n == 5 && rbuf_cmpn(&connection->input, "PURGE", 5) == 0)) {`
`206`	`206`	`//This is a BULK request`
`207`	`207`	`connection->type = REQUEST_HTTPPURGE;`
`208`	`208`	`assert(REQUEST_IS(connection->type, connection->type));`