Repository: trafficserver Updated Branches: refs/heads/master 70823455f -> 4211c8ab2
[TS-3121] - Prevent sending garbage HTTP/0.9 responses from SPDY Project: http://git-wip-us.apache.org/repos/asf/trafficserver/repo Commit: http://git-wip-us.apache.org/repos/asf/trafficserver/commit/4211c8ab Tree: http://git-wip-us.apache.org/repos/asf/trafficserver/tree/4211c8ab Diff: http://git-wip-us.apache.org/repos/asf/trafficserver/diff/4211c8ab Branch: refs/heads/master Commit: 4211c8ab21ecec72132e9485285719984bb9e5b6 Parents: 7082345 Author: Sudheer Vinukonda <[email protected]> Authored: Wed Oct 8 16:10:18 2014 +0000 Committer: Sudheer Vinukonda <[email protected]> Committed: Wed Oct 8 16:10:18 2014 +0000 ---------------------------------------------------------------------- proxy/spdy/SpdyClientSession.cc | 5 +++++ proxy/spdy/SpdyCommon.cc | 3 +++ proxy/spdy/SpdyCommon.h | 3 +++ 3 files changed, 11 insertions(+) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/trafficserver/blob/4211c8ab/proxy/spdy/SpdyClientSession.cc ---------------------------------------------------------------------- diff --git a/proxy/spdy/SpdyClientSession.cc b/proxy/spdy/SpdyClientSession.cc index 8dcfadb..6338022 100644 --- a/proxy/spdy/SpdyClientSession.cc +++ b/proxy/spdy/SpdyClientSession.cc @@ -363,6 +363,11 @@ spdy_process_fetch_header(TSEvent /*event*/, SpdyClientSession *sm, TSFetchSM fe SpdyRequest *req = (SpdyRequest *)TSFetchUserDataGet(fetch_sm); SpdyNV spdy_nv(fetch_sm); + + if (spdy_nv.is_valid_response()) { + Debug("spdy_error", "----spdy_process_fetch_header, invalid http response"); + return -1; + } Debug("spdy", "----spdylay_submit_syn_reply"); if (sm->session) { http://git-wip-us.apache.org/repos/asf/trafficserver/blob/4211c8ab/proxy/spdy/SpdyCommon.cc ---------------------------------------------------------------------- diff --git a/proxy/spdy/SpdyCommon.cc b/proxy/spdy/SpdyCommon.cc index eee4cb0..8ac010c 100644 --- a/proxy/spdy/SpdyCommon.cc +++ b/proxy/spdy/SpdyCommon.cc @@ -95,8 +95,11 @@ SpdyNV::SpdyNV(TSFetchSM fetch_sm) nr_fields = TSMimeHdrFieldsCount(bufp, loc); + valid_response = true; + if (nr_fields <= 0) { Debug("spdy_error", "invalid fetchsm %p, nr_fields %d, hdr_len %d", fetch_sm, nr_fields, hdr_len); + valid_response = false; } nv = (const char **)malloc((2*nr_fields + 5) * sizeof(char *)); http://git-wip-us.apache.org/repos/asf/trafficserver/blob/4211c8ab/proxy/spdy/SpdyCommon.h ---------------------------------------------------------------------- diff --git a/proxy/spdy/SpdyCommon.h b/proxy/spdy/SpdyCommon.h index 3425ad3..e14f232 100644 --- a/proxy/spdy/SpdyCommon.h +++ b/proxy/spdy/SpdyCommon.h @@ -83,11 +83,14 @@ public: SpdyNV(TSFetchSM fetch_sm); ~SpdyNV(); + bool is_valid_response(); + public: const char **nv; private: SpdyNV(); + bool valid_response; void *mime_hdr; char status[64]; char version[64];
