Repository navigation
Drop a response whose Content-Length headers disagree - #2237
Merged
Merged
Conversation
The header parser kept the last Content-Length it read, so a response carrying "Content-Length: 16" and then "Content-Length: 8" was saved cut at 8 bytes. RFC 9112 6.3 calls differing lengths an unrecoverable framing error: the client must close the connection and discard the response. hts_content_length_agrees() now compares each value with the ones before it, including list values such as "16, 8". The header loop in htsback.c fails the transfer when they differ. Equal repeats stay accepted, as RFC 9110 8.6 allows. A single malformed value such as "16 bytes" is still read leniently. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
The helper stopped at the first element it could not read, so "16,,8" and "16, x, 8" passed with the 8 never compared. It now skips empty elements and text that is no number, and goes on to the next one. A signed or oversized number counts as a length of its own. An over-long Content-Length line that binput_line cuts counts as a conflict, because the value it hides cannot be compared. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
A 1xx block frames no body, so its lengths cannot desync anything, and master accepted the final response that follows it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A response whose
Content-Lengthheaders give different values is now dropped and its connection closed, as RFC 9112 §6.3 requires. Before, the last value won, so a file could be saved cut short. Repeated equal values, including a list such as16, 16, are still accepted. AContent-Lengthline too long to read whole also drops the response, because the value it hides cannot be compared. A single malformed value such as16 bytesis still read as before.