From 25c9d0c38d659cc00db461d760f66369e9024c54 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Johannes=20Wei=C3=9Fl?= <jargon@molb.org>
Date: Sat, 14 Nov 2015 16:29:13 +0100
Subject: inets: Terminate really gracefully on bad chunk
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Without this fix, httpc:request/1 crashes the httpc_handler when an
invalid chunked length header is encountered (since 77acb47):

    =ERROR REPORT==== 14-Nov-2015::17:19:30 ===
    ** Generic server <0.651.0> terminating
    ** Last message in was {tcp,#Port<0.5714>,
                                <<"HTTP/1.1 200 ok\r\nTransfer-Encoding:chunked\r\n\r\nåäö\r\n">>}
    ** When Server state == {state,
    [...]
    ** Reason for termination ==
    ** {bad_return_value,{error,{chunk_size,"åäö"}}}
---
 lib/inets/src/http_client/httpc_handler.erl | 11 +++++++++--
 lib/inets/test/httpc_SUITE.erl              | 21 +++++++++++++++++++++
 2 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/lib/inets/src/http_client/httpc_handler.erl b/lib/inets/src/http_client/httpc_handler.erl
index 1044cffe6f..e6dcfee818 100644
--- a/lib/inets/src/http_client/httpc_handler.erl
+++ b/lib/inets/src/http_client/httpc_handler.erl
@@ -1113,8 +1113,8 @@ handle_http_body(Body, #state{headers       = Headers,
     case case_insensitive_header(TransferEnc) of
         "chunked" ->
 	    ?hcrt("handle_http_body - chunked", []),
-	    case http_chunk:decode(Body, State#state.max_body_size, 
-				   State#state.max_header_size) of
+	    try http_chunk:decode(Body, State#state.max_body_size, 
+				  State#state.max_header_size) of
 		{Module, Function, Args} ->
 		    ?hcrt("handle_http_body - new mfa", 
 			  [{module,   Module}, 
@@ -1139,6 +1139,13 @@ handle_http_body(Body, #state{headers       = Headers,
                            handle_response(State#state{headers = NewHeaders,
                                        body    = NewBody2})
                     end
+	    catch throw:{error, Reason} ->
+		NewState =
+		    answer_request(Request,
+				   httpc_response:error(Request,
+							Reason),
+				   State),
+		    {stop, normal, NewState}
 	    end;
         Enc when Enc =:= "identity"; Enc =:= undefined ->
             ?hcrt("handle_http_body - identity", []),
diff --git a/lib/inets/test/httpc_SUITE.erl b/lib/inets/test/httpc_SUITE.erl
index 989563cdbc..c6c59ab1af 100644
--- a/lib/inets/test/httpc_SUITE.erl
+++ b/lib/inets/test/httpc_SUITE.erl
@@ -106,6 +106,7 @@ only_simulated() ->
      bad_response,
      internal_server_error,
      invalid_http,
+     invalid_chunk_size,
      headers_dummy,
      headers_with_obs_fold,
      empty_response_header,
@@ -765,6 +766,22 @@ invalid_http(Config) when is_list(Config) ->
     ct:print("Parse error: ~p ~n", [Reason]).
 
 %%-------------------------------------------------------------------------
+
+invalid_chunk_size(doc) ->
+    ["Test parse error of HTTP chunk size"];
+invalid_chunk_size(suite) ->
+    [];
+invalid_chunk_size(Config) when is_list(Config) ->
+
+    URL = url(group_name(Config), "/invalid_chunk_size.html", Config),
+
+    {error, {chunk_size, _} = Reason} =
+	httpc:request(get, {URL, []}, [], []),
+
+    ct:print("Parse error: ~p ~n", [Reason]).
+
+%%-------------------------------------------------------------------------
+
 emulate_lower_versions(doc) ->
     [{doc, "Perform request as 0.9 and 1.0 clients."}];
 emulate_lower_versions(Config) when is_list(Config) ->
@@ -1876,6 +1893,10 @@ handle_uri(_,"/invalid_http.html",_,_,_,_) ->
     "HTTP/1.1 301\r\nDate:Sun, 09 Dec 2007 13:04:18 GMT\r\n" ++
 	"Transfer-Encoding:chunked\r\n\r\n";
 
+handle_uri(_,"/invalid_chunk_size.html",_,_,_,_) ->
+    "HTTP/1.1 200 ok\r\n" ++
+	"Transfer-Encoding:chunked\r\n\r\nåäö\r\n";
+
 handle_uri(_,"/missing_reason_phrase.html",_,_,_,_) ->
     "HTTP/1.1 200\r\n" ++
 	"Content-Length: 32\r\n\r\n"
-- 
cgit v1.2.3