Bug 5552: Buffer overflow when parsing deny_info NNN w/o URL - #2481
Bug 5552: Buffer overflow when parsing deny_info NNN w/o URL#2481rousskov wants to merge 1 commit into
Conversation
deny_info 307 The bug affected deny_info status codes 200-599. The bug was introduced with the initial support for custom status codes (2011 commit aed9a15).
| filenameOrUri = page_name; | ||
| } | ||
|
|
||
| const auto looksLikeUrl = [](const char * const name) { return name && strchr(name, ':'); }; |
There was a problem hiding this comment.
Since all current callers supply the same filenameOrUri argument, and that argument does not change after this line, we can make looksLikeUrl a boolean constant, but a lambda makes this (quite messy and difficult-to-follow!) code more readable IMO.
This lambda will be called twice, but an optimizing compiler may be able to avoid the second call, and deny_info configuration parsing is not a particularly performance-sensitive functionality.
There was a problem hiding this comment.
Wouldn't this belong better in anyp/Uri?
There was a problem hiding this comment.
Wouldn't this belong better in anyp/Uri?
This specific heuristic may not be suitable for safe reuse in some other contexts looking for URIs. This simple lambda is context-specific.
There may be other contexts were the underlying heuristic would work correctly, but we would need to find a more suitable name (to fend off callers that should use another logic). Something like ContainsColon() is too low-level and not worth wrapping/naming!
Before we settle on the new name and other details, we would also need to find other suitable callers. Then we will need to convert them.
I am not against making this one-liner more reusable, but would rather not spend my time on that right now, especially in a surgical bug-fixing PR.
rousskov
added
the
S-could-use-an-approval
kinkie
added
S-waiting-for-author
rousskov
added
S-could-use-an-approval
2 participants
The bug affected deny_info status codes 200-599. The bug was introduced
with the initial support for custom status codes (2011 commit aed9a15).