From 4eeeca1538afecc294e04c50c5f6a4551eced9ec Mon Sep 17 00:00:00 2001
From: Ingela Anderton Andin <ingela@erlang.org>
Date: Tue, 27 Jan 2015 17:00:28 +0100
Subject: inets: httpd - Sanity check of content-length header

Gracefully handle invalid content-lenght headers instead of
crashing in list_to_integer.
---
 lib/inets/src/http_lib/http_internal.hrl |  3 ++-
 lib/inets/src/http_lib/http_request.erl  | 26 ++++++++++++++++----------
 2 files changed, 18 insertions(+), 11 deletions(-)

(limited to 'lib/inets/src/http_lib')

diff --git a/lib/inets/src/http_lib/http_internal.hrl b/lib/inets/src/http_lib/http_internal.hrl
index 53b776c4e7..54425740b5 100644
--- a/lib/inets/src/http_lib/http_internal.hrl
+++ b/lib/inets/src/http_lib/http_internal.hrl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2002-2014. All Rights Reserved.
+%% Copyright Ericsson AB 2002-2015. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -28,6 +28,7 @@
 -define(HTTP_MAX_URI_SIZE,    nolimit).
 -define(HTTP_MAX_VERSION_STRING, 8).
 -define(HTTP_MAX_METHOD_STRING, 20).
+-define(HTTP_MAX_CONTENT_LENGTH, 100000000).
 
 -ifndef(HTTP_DEFAULT_SSL_KIND).
 -define(HTTP_DEFAULT_SSL_KIND, essl).
diff --git a/lib/inets/src/http_lib/http_request.erl b/lib/inets/src/http_lib/http_request.erl
index f295453bdd..a0833ddf01 100644
--- a/lib/inets/src/http_lib/http_request.erl
+++ b/lib/inets/src/http_lib/http_request.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %% 
-%% Copyright Ericsson AB 2005-2014. All Rights Reserved.
+%% Copyright Ericsson AB 2005-2015. All Rights Reserved.
 %% 
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -21,8 +21,16 @@
 
 -include("http_internal.hrl").
 
--export([headers/2, http_headers/1, is_absolut_uri/1]).
+-export([headers/2, http_headers/1, is_absolut_uri/1, key_value/1]).
 
+
+key_value(KeyValueStr) ->
+    case lists:splitwith(fun($:) -> false; (_) -> true end, KeyValueStr) of
+	{Key, [$: | Value]} ->
+	    {http_util:to_lower(string:strip(Key)),  string:strip(Value)};
+	{_, []} -> 
+	    undefined
+    end.
 %%-------------------------------------------------------------------------
 %% headers(HeaderList, #http_request_h{}) -> #http_request_h{}
 %%   HeaderList - ["HeaderField:Value"]     	
@@ -34,14 +42,12 @@
 %%-------------------------------------------------------------------------
 headers([], Headers) ->
     Headers;
-headers([Header | Tail], Headers) ->  
-    case lists:splitwith(fun($:) -> false; (_) -> true end, Header) of
-	{Key, [$: | Value]}  ->
-	    headers(Tail, headers(http_util:to_lower(string:strip(Key)), 
-				  string:strip(Value), Headers));
-	{_, []} -> 
-	    headers(Tail, Headers)
-    end.
+headers([{Key, Value} | Tail], Headers) ->  
+    headers(Tail, headers(Key, Value, Headers));
+headers([undefined], Headers) -> 
+    Headers;
+headers(KeyValues, Headers) -> 
+    headers([key_value(KeyValue) || KeyValue <-  KeyValues], Headers).
 
 %%-------------------------------------------------------------------------
 %% headers(#http_request_h{}) -> HeaderList
-- 
cgit v1.2.3