From 80ce0ac4458c549fd0969333dfbbf8b3233cf544 Mon Sep 17 00:00:00 2001
From: Sverker Eriksson <sverker@erlang.org>
Date: Wed, 24 Mar 2010 19:57:07 +0100
Subject: Fix erlang:decode_packet(httph_bin,..) to not return faulty header
 strings

Unrecognized Http header names was sometimes returned as corrupt
sub-binaries pointing to a stack allocated buffer. This only happened
on 32-bit VM if the header name was between 16 and 20 characters
long. It could in some cases lead to segmentation fault.
The solution was to avoid creating sub-binary if the returned string
was not part of the original binary.
---
 erts/emulator/test/decode_packet_SUITE.erl | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

(limited to 'erts/emulator/test')

diff --git a/erts/emulator/test/decode_packet_SUITE.erl b/erts/emulator/test/decode_packet_SUITE.erl
index 13f17e972c..add14ac87c 100644
--- a/erts/emulator/test/decode_packet_SUITE.erl
+++ b/erts/emulator/test/decode_packet_SUITE.erl
@@ -24,10 +24,10 @@
 -include("test_server.hrl").
 
 -export([all/1,init_per_testcase/2,fin_per_testcase/2,
-	 basic/1, packet_size/1, neg/1, http/1, line/1, ssl/1]).
+	 basic/1, packet_size/1, neg/1, http/1, line/1, ssl/1, otp_8536/1]).
 
 all(suite) ->
-    [basic, packet_size, neg, http, line, ssl].
+    [basic, packet_size, neg, http, line, ssl, otp_8536].
 
 init_per_testcase(Func, Config) when is_atom(Func), is_list(Config) ->
     Seed = {S1,S2,S3} = now(),
@@ -504,6 +504,27 @@ ssl(Config) when is_list(Config) ->
     F(v2hello),
     ok.
 
+otp_8536(doc) -> ["Corrupt sub-binary-strings from httph_bin"];
+otp_8536(Config) when is_list(Config) ->
+    lists:foreach(fun otp_8536_do/1, lists:seq(1,50)),
+    ok.
+
+otp_8536_do(N) ->
+    Data = <<"some data 123">>,
+    Letters = <<"bcdefghijklmnopqrstuvwxyzyxwvutsrqponmlkjihgfedcba">>,
+    <<HdrTail:N/binary,_/binary>> = Letters,
+    Hdr = <<$A, HdrTail/binary>>,
+    Bin = <<Hdr/binary, ": ", Data/binary, "\r\n\r\n">>,
+
+    io:format("Bin='~p'\n",[Bin]),
+    ?line {ok,{http_header,0,Hdr2,undefined,Data2},<<"\r\n">>} = decode_pkt(httph_bin, Bin,  []),
+
+    %% Do something to trash the C-stack, how about another decode_packet:
+    decode_pkt(httph_bin,<<Letters/binary, ": ", Data/binary, "\r\n\r\n">>, []),
+
+    %% Now check that we got the expected binaries
+    {Hdr, Data} = {Hdr2, Data2}.
+
 decode_pkt(Type,Bin) ->
     decode_pkt(Type,Bin,[]).		       
 decode_pkt(Type,Bin,Opts) ->
-- 
cgit v1.2.3