| Subject: | Stack corruption in HTTP::Server::EV EV.xs |
| Date: | Tue, 16 Apr 2013 16:22:56 +0200 |
| To: | bug-HTTP-Server-EV [...] rt.cpan.org |
| From: | Edgar Fuß <ef [...] math.uni-bonn.de> |
I noticed stack corruption (caught by gcc's stack protector) on certain requests.
It turned out to happen as soon as the name of a HTTP Header exceeded 20.
The problem is that sizeof(state->buf) gives you the size of state->buf, i.e. sizeof(char *), not the size of the malloc()'ed area as you seem to expect.
There's a similar bug elsewhere where you take sizeof(buf), with buf being a pointer to a struct sockaddr -- you need to take sizeof(*buf) there.
Also, you multiply a bunch of values by sizeof(char), which is useless, because it's defined to be 1 -- maybe you do that for aesthetical reasons, though. I didn't change that.
The attached patch fixes the two sizeof() issues and make my crashes disappear.
Message body is not shown because sender requested not to inline it.