Fossil SCM
The chunk size is authoritative, so if more data than that is supplied we should not read it. From libfossil.
Commit
e288a41b3b1fdb279926cc853ecc1120ba2d4ff4af7c5287c0eaee048e73db73
Parent
6362cc0666eaa53…
1 file changed
+8
-1
+8
-1
| --- src/http.c | ||
| +++ src/http.c | ||
| @@ -859,11 +859,18 @@ | ||
| 859 | 859 | nPrior += nGot; |
| 860 | 860 | nRemaining -= nGot; |
| 861 | 861 | pReply->nUsed = (unsigned int)nPrior; |
| 862 | 862 | } |
| 863 | 863 | } |
| 864 | - transport_receive_line(&g.url); /* CRLF that follows the chunk data */ | |
| 864 | + /* The chunk data ends with CRLF (RFC 9112 section 7.1), which | |
| 865 | + ** reads as an empty line. Anything else means the chunk size | |
| 866 | + ** was wrong. */ | |
| 867 | + zChunk = transport_receive_line(&g.url); | |
| 868 | + if( zChunk==0 || zChunk[0]!=0 ){ | |
| 869 | + fossil_warning("chunked reply: no line end after chunk data"); | |
| 870 | + goto write_err; | |
| 871 | + } | |
| 865 | 872 | } |
| 866 | 873 | if( !sawTerminator ){ |
| 867 | 874 | /* The loop exited without ever seeing the 0-length terminator chunk, |
| 868 | 875 | ** meaning the peer closed before the body was complete. A truncated |
| 869 | 876 | ** sync must be an error, never silent success. */ |
| 870 | 877 |
| --- src/http.c | |
| +++ src/http.c | |
| @@ -859,11 +859,18 @@ | |
| 859 | nPrior += nGot; |
| 860 | nRemaining -= nGot; |
| 861 | pReply->nUsed = (unsigned int)nPrior; |
| 862 | } |
| 863 | } |
| 864 | transport_receive_line(&g.url); /* CRLF that follows the chunk data */ |
| 865 | } |
| 866 | if( !sawTerminator ){ |
| 867 | /* The loop exited without ever seeing the 0-length terminator chunk, |
| 868 | ** meaning the peer closed before the body was complete. A truncated |
| 869 | ** sync must be an error, never silent success. */ |
| 870 |
| --- src/http.c | |
| +++ src/http.c | |
| @@ -859,11 +859,18 @@ | |
| 859 | nPrior += nGot; |
| 860 | nRemaining -= nGot; |
| 861 | pReply->nUsed = (unsigned int)nPrior; |
| 862 | } |
| 863 | } |
| 864 | /* The chunk data ends with CRLF (RFC 9112 section 7.1), which |
| 865 | ** reads as an empty line. Anything else means the chunk size |
| 866 | ** was wrong. */ |
| 867 | zChunk = transport_receive_line(&g.url); |
| 868 | if( zChunk==0 || zChunk[0]!=0 ){ |
| 869 | fossil_warning("chunked reply: no line end after chunk data"); |
| 870 | goto write_err; |
| 871 | } |
| 872 | } |
| 873 | if( !sawTerminator ){ |
| 874 | /* The loop exited without ever seeing the 0-length terminator chunk, |
| 875 | ** meaning the peer closed before the body was complete. A truncated |
| 876 | ** sync must be an error, never silent success. */ |
| 877 |