From cf322b224a12443f3f9a9c4ecf5a58fcab23874b Mon Sep 17 00:00:00 2001 From: Gonzalo Paniagua Javier Date: Tue, 20 Apr 2010 15:54:28 +0000 Subject: [PATCH] 2010-04-20 Gonzalo Paniagua Javier * ChunkStream.cs: ignore chunk extensions when reading the chunk size. Fixes bug #597556. svn path=/trunk/mcs/; revision=155815 --- mcs/class/System/System.Net/ChangeLog | 5 +++++ mcs/class/System/System.Net/ChunkStream.cs | 19 +++++++++++++++---- 2 files changed, 20 insertions(+), 4 deletions(-) diff --git a/mcs/class/System/System.Net/ChangeLog b/mcs/class/System/System.Net/ChangeLog index 0a5c8946fbf..8439feee2a5 100644 --- a/mcs/class/System/System.Net/ChangeLog +++ b/mcs/class/System/System.Net/ChangeLog @@ -1,3 +1,8 @@ +2010-04-20 Gonzalo Paniagua Javier + + * ChunkStream.cs: ignore chunk extensions when reading the chunk + size. Fixes bug #597556. + 2010-04-15 Gonzalo Paniagua Javier * HttpWebRequest.cs: set content length to -1 on redirect. Reset diff --git a/mcs/class/System/System.Net/ChunkStream.cs b/mcs/class/System/System.Net/ChunkStream.cs index 3e4c08f1930..0edb422370b 100644 --- a/mcs/class/System/System.Net/ChunkStream.cs +++ b/mcs/class/System/System.Net/ChunkStream.cs @@ -230,8 +230,9 @@ namespace System.Net ThrowProtocolViolation ("Missing \\n"); try { - if (saved.Length > 0) - chunkSize = Int32.Parse (saved.ToString (), NumberStyles.HexNumber); + if (saved.Length > 0) { + chunkSize = Int32.Parse (RemoveChunkExtension (saved.ToString ()), NumberStyles.HexNumber); + } } catch (Exception) { ThrowProtocolViolation ("Cannot parse chunk size."); } @@ -241,7 +242,7 @@ namespace System.Net chunkRead = 0; try { - chunkSize = Int32.Parse (saved.ToString (), NumberStyles.HexNumber); + chunkSize = Int32.Parse (RemoveChunkExtension (saved.ToString ()), NumberStyles.HexNumber); } catch (Exception) { ThrowProtocolViolation ("Cannot parse chunk size."); } @@ -254,6 +255,14 @@ namespace System.Net return State.Body; } + static string RemoveChunkExtension (string input) + { + int idx = input.IndexOf (';'); + if (idx == -1) + return input; + return input.Substring (0, idx); + } + State ReadCRLF (byte [] buffer, ref int offset, int size) { if (!sawCR) { @@ -302,12 +311,14 @@ namespace System.Net if (st > 0) { saved.Append (stString.Substring (0, saved.Length == 0? st-2: st)); st = 0; + if (saved.Length > 4196) + ThrowProtocolViolation ("Error reading trailer (too long)."); } } if (st < 4) { trailerState = st; - if (offset < size) + if (offset < size) ThrowProtocolViolation ("Error reading trailer."); return State.Trailer; -- 2.25.1