| Andrew Geissler | 6aa7eec | 2023-03-03 12:41:14 -0600 | [diff] [blame^] | 1 | From 3764b8551463b900b5b4e3ec0cd9bb9182191cb7 Mon Sep 17 00:00:00 2001 |
| 2 | From: rofl0r <rofl0r@users.noreply.github.com> |
| 3 | Date: Thu, 8 Sep 2022 15:18:04 +0000 |
| 4 | Subject: [PATCH] prevent junk from showing up in error page in invalid |
| 5 | requests |
| 6 | |
| 7 | fixes #457 |
| 8 | |
| 9 | https://github.com/tinyproxy/tinyproxy/commit/3764b8551463b900b5b4e3ec0cd9bb9182191cb7 |
| 10 | Upstream-Status: Backport |
| 11 | CVE: CVE-2022-40468 |
| 12 | Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> |
| 13 | --- |
| 14 | src/reqs.c | 4 ++++ |
| 15 | 1 file changed, 4 insertions(+) |
| 16 | |
| 17 | diff --git a/src/reqs.c b/src/reqs.c |
| 18 | index bce69819..45db118d 100644 |
| 19 | --- a/src/reqs.c |
| 20 | +++ b/src/reqs.c |
| 21 | @@ -343,8 +343,12 @@ static struct request_s *process_request (struct conn_s *connptr, |
| 22 | goto fail; |
| 23 | } |
| 24 | |
| 25 | + /* zero-terminate the strings so they don't contain junk in error page */ |
| 26 | + request->method[0] = url[0] = request->protocol[0] = 0; |
| 27 | + |
| 28 | ret = sscanf (connptr->request_line, "%[^ ] %[^ ] %[^ ]", |
| 29 | request->method, url, request->protocol); |
| 30 | + |
| 31 | if (ret == 2 && !strcasecmp (request->method, "GET")) { |
| 32 | request->protocol[0] = 0; |
| 33 | |