diff options
| author | Dirk Engling <erdgeist@erdgeist.org> | 2026-11-07 13:30:17 +0100 |
|---|---|---|
| committer | Dirk Engling <erdgeist@erdgeist.org> | 2026-11-07 13:30:17 +0100 |
| commit | cfbe53da5d9ef8dad1bb3276c0b33ec2ab6e974b (patch) | |
| tree | c553990fd398d9d20dab09df5ecdcba1da71264e /src/ot_http.c | |
| parent | bbfd674e08c6b1fa4081f9c678fd220bead749d7 (diff) | |
Fix s24s stats to ensure no unallocated vector is dereferenced. Drive-by fix for the ip= scanner in the http parser
Diffstat (limited to 'src/ot_http.c')
| -rw-r--r-- | src/ot_http.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/ot_http.c b/src/ot_http.c index 1b5281c..262936e 100644 --- a/src/ot_http.c +++ b/src/ot_http.c | |||
| @@ -692,8 +692,10 @@ static ssize_t http_handle_announce(const int64_t sock, struct ot_workstruct | |||
| 692 | { | 692 | { |
| 693 | char *tmp_buf1 = ws->reply, *tmp_buf2 = ws->reply + 16; | 693 | char *tmp_buf1 = ws->reply, *tmp_buf2 = ws->reply + 16; |
| 694 | len = urlencoded_parse(&read_ptr, tmp_buf2, ws->outbuf + G_OUTBUF_SIZE, SCAN_SEARCHPATH_VALUE); | 694 | len = urlencoded_parse(&read_ptr, tmp_buf2, ws->outbuf + G_OUTBUF_SIZE, SCAN_SEARCHPATH_VALUE); |
| 695 | if (len <= 0) | ||
| 696 | HTTPERROR_400_PARAM; | ||
| 695 | tmp_buf2[len] = 0; | 697 | tmp_buf2[len] = 0; |
| 696 | if ((len <= 0) || ip_parse(tmp_buf2, tmp_buf1) != (size_t)len) | 698 | if (ip_parse(tmp_buf2, tmp_buf1) != (size_t)len) |
| 697 | HTTPERROR_400_PARAM; | 699 | HTTPERROR_400_PARAM; |
| 698 | OT_SETIP(&ws->peer, tmp_buf1); | 700 | OT_SETIP(&ws->peer, tmp_buf1); |
| 699 | } break; | 701 | } break; |
