GoHttp

GoHttp copied to clipboard

stack-buffer-overflow 619 characters in User-Agent string causes stack-overflow.

2

root@0xGotcha:~/fuzzing/GoHttp# curl -A "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" localhost:7000 root@0xGotcha:~/fuzzing/GoHttp# ./GoHttp Settings: Port: 7000 Server root: /home/frw/public_html/ Configuration file: httpd.conf Logfile: .log Deamon: 0 ================================================================= ==1666==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff1110bd40 at pc 0x000000487f40...

0xGotcha

Fix/Find buffer overflows

1

There's potential buffer overflows. Fix them ASAP.

fekberg

Scan should return output length

7

this change will make scan return the length of the output string. Closes #13

ztbrown

Scan returns the length of the string from 0 to the end of the output. If this is unintended behavior, I would suggest returning `i - start` instead of `i`.

ztbrown

If you press and hold F5 and "stress" the server, the file you request will sometimes be unavailable.

fekberg

Write a blog post about the web server and how everything in it works so far. Explain the basics of HTTP and the parsing that is done and how the...

fekberg

The code needs to be refactored, the method names and variables should correspond with the C standard.

fekberg