git: 9front

Download patch

ref: ea4fdc625c5e9fae996f224d6ab988cca10e21e7
parent: 5c73236ad1235b857433fc905b1845a908c5b3a6
author: cinap_lenrek <cinap_lenrek@gmx.de>
date: Thu Jan 31 17:51:21 EST 2013 

httpd: fix rane requests

we gave wrong content-length in range requests. r->stop - r->start
is wrong because r->stop is the byte offset of the *last* byte, not
the *next* byte after the last.


--- a/sys/src/cmd/ip/httpd/sendfd.c
+++ b/sys/src/cmd/ip/httpd/sendfd.c
@@ -127,7 +127,7 @@
 			hprint(hout, "Content-Length: %lld\r\n", length);
 		else if(r->next == nil){
 			hprint(hout, "Content-Range: bytes %ld-%ld/%lld\r\n", r->start, r->stop, length);
-			hprint(hout, "Content-Length: %ld\r\n", r->stop - r->start);
+			hprint(hout, "Content-Length: %ld\r\n", 1 + r->stop - r->start);
 		}else{
 			multir = 1;
 			boundary = hmkmimeboundary(c);
@@ -196,7 +196,7 @@
 			hprint(hout, "\r\n--%s\r\n", boundary);
 			printtype(hout, type, enc);
 			hprint(hout, "Content-Range: bytes %ld-%ld/%lld\r\n", r->start, r->stop, length);
-			hprint(hout, "Content-Length: %ld\r\n", r->stop - r->start);
+			hprint(hout, "Content-Length: %ld\r\n", 1 + r->stop - r->start);
 			hprint(hout, "\r\n");
 		}
 		hflush(hout);
@@ -205,7 +205,7 @@
 			ok = -1;
 			break;
 		}
-		for(tr = r->stop - r->start + 1; tr; tr -= n){
+		for(tr = 1 + r->stop - r->start; tr; tr -= n){
 			n = tr;
 			if(n > HBufSize)
 				n = HBufSize;
@@ -418,6 +418,10 @@
 	rr = nil;
 	for(r = h; r != nil; r = r->next){
 		if(r->suffix){
+			/*
+			 * for suffix, r->stop is a byte *length*
+			 * not the byte *offset* of last byte!
+			 */
 			r->start = length - r->stop;
 			if(r->start >= length)
 				r->start = 0;
-- 
⑨