Skip to content
This repository was archived by the owner on Nov 6, 2022. It is now read-only.
This repository was archived by the owner on Nov 6, 2022. It is now read-only.

http_parser_parse_url fails to handle very long URLs #481

Open
@piru

Description

@piru

http_parser_parse_url quietly fails to parse very long URLs. Instead it will return invalid off and len values. There could be a security impact in this issue in situations where the parse result data would be used to make security related decisions (for example the parsed path might be different in actual URL vs the parsed one).

PR #480 is a proposed fix to this issue. Alternatively if the existing ABI must be maintained, the code should be changed to return an error if off or len overflow (become > UINT16_MAX).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions