Imposed some limits on request parts.

[ashd.git] / lib / req.c

diff --git a/lib/req.c b/lib/req.c
index 64944bf..da8e3f0 100644 (file)
--- a/lib/req.c
+++ b/lib/req.c
@@ -23,6 +23,7 @@
 #include <errno.h>
 #include <ctype.h>
 #include <stdio.h>
+#include <fcntl.h>
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
@@ -105,12 +106,16 @@ int parseheaders(struct hthead *head, FILE *in)
 {
     int c, state;
     struct charbuf name, val;
+    size_t tsz;
     
     bufinit(name);
     bufinit(val);
     state = 0;
+    tsz = 0;
     while(1) {
        c = fgetc(in);
+       if(++tsz >= 65536)
+           goto fail;
     again:
        if(state == 0) {
            if(c == '\r') {
@@ -254,6 +259,7 @@ int recvreq(int sock, struct hthead **reqp)
     if((fd = recvfd(sock, &buf.b, &buf.d)) < 0) {
        return(-1);
     }
+    fcntl(fd, F_SETFD, FD_CLOEXEC);
     buf.s = buf.d;
     p = buf.b;
     l = buf.d;