Package: uwsgi-core
Version: 2.0.7-1
Dear Maintainer,
The language-independent readline implementation in uwsgi's
core/reader.c appears to contain a flaw causing it to append extra bytes
from the readline buffer to the final line returned, if the request body
is not terminated by a newline. Reproducing this seems to require that
the request body is at least 4KB in size.
The issue originally appeared in context of running a Python application
with the uswgi Python plugin, but investigation led me to believe that
it's in the uwsgi core itself. The issue is also present in upstream.
The fix seems to be to replace near the end of
uwsgi_request_body_readline():
*rlen = wsgi_req->post_readline_size - wsgi_req->post_readline_pos;
with:
*rlen = wsgi_req->post_readline_watermark - wsgi_req->post_readline_pos;
To reproduce:
* Install uwsgi, uwsgi-plugin-python3, python3-werkzeug
* Run the attached repro-app.py with: uwsgi_python34 --socket
0.0.0.0:8080 --protocol=http -w repro-app
* Generate a multiline request body >4KB with: ( for x in $(seq -w
1000); do echo $x; done; echo -n "final" ) >data.txt
* Send request to uwsgi: curl http://localhost:8080/ --data-binary
@data.txt >data2.txt
Expected:
data.txt and data2.txt are identical
Actual:
data2.txt contains data in data.txt, followed by several lines of extra
data from the readline buffer.
While this reproduction only causes extra data from the readline buffer
to be returned, we have also seen cases where the returned extra bytes
seem to be other unrelated data from the process heap. This has probably
been caused by consume_body_for_readline() having realloced the buffer
just before.
-- System Information:
Debian Release: 8.3
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 4.6.0-0.bpo.1-amd64 (SMP w/4 CPU cores)
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Shell: /bin/sh linked to /bin/dash
Init: unable to detect
Versions of packages uwsgi-core depends on:
ii libc6 2.19-18+deb8u6
ii libcap2 1:2.24-8
ii libjansson4 2.7-1+deb8u1
ii libmatheval1 1.1.11+dfsg-2
ii libpam0g 1.1.8-3.1+deb8u1
ii libpcre3 2:8.35-3.3+deb8u2
ii libssl1.0.0 1.0.1k-3+deb8u4
ii libuuid1 2.25.2-6
ii libxml2 2.9.1+dfsg1-5+deb8u3
ii libyaml-0-2 0.1.6-3
ii libzmq3 4.0.5+dfsg-2+deb8u1
ii zlib1g 1:1.2.8.dfsg-2+b1
uwsgi-core recommends no packages.
Versions of packages uwsgi-core suggests:
ii nginx-full 1.6.2-5+deb8u4
pn uwsgi-extra <none>
pn uwsgi-plugins-all <none>
-- no debconf information
#!/usr/bin/python3
import uwsgi
from werkzeug.wrappers import Request, Response
def application(env, start_response):
request = Request(env)
lines = b""
while True:
line = request.stream.readline()
if not line:
break;
lines += line
response = Response(lines)
return response(env, start_response)
