svn commit: trunk/busybox: libbb networking

vda at busybox.net vda at busybox.net
Sat Aug 11 20:20:03 UTC 2007


Author: vda
Date: 2007-08-11 13:20:02 -0700 (Sat, 11 Aug 2007)
New Revision: 19435

Log:
httpd: fix CGI handling bug (we were closing wrong fd).



Modified:
   trunk/busybox/libbb/vdprintf.c
   trunk/busybox/networking/httpd.c


Changeset:
Modified: trunk/busybox/libbb/vdprintf.c
===================================================================
--- trunk/busybox/libbb/vdprintf.c	2007-08-11 19:01:12 UTC (rev 19434)
+++ trunk/busybox/libbb/vdprintf.c	2007-08-11 20:20:02 UTC (rev 19435)
@@ -15,7 +15,7 @@
 	char buf[BUF_SIZE];
 	int len;
 
-	len = vsprintf(buf, format, ap);
+	len = vsnprintf(buf, BUF_SIZE, format, ap);
 	return write(d, buf, len);
 }
 #endif

Modified: trunk/busybox/networking/httpd.c
===================================================================
--- trunk/busybox/networking/httpd.c	2007-08-11 19:01:12 UTC (rev 19434)
+++ trunk/busybox/networking/httpd.c	2007-08-11 20:20:02 UTC (rev 19435)
@@ -989,8 +989,8 @@
 		const char *request, int bodyLen, const char *cookie,
 		const char *content_type)
 {
-	int fromCgi[2];  /* pipe for reading data from CGI */
-	int toCgi[2];    /* pipe for sending data to CGI */
+	struct { int rd; int wr; } fromCgi;  /* CGI -> httpd pipe */
+	struct { int rd; int wr; } toCgi;    /* httpd -> CGI pipe */
 	char *fullpath;
 	char *argp[] = { NULL, NULL };
 	int pid = 0;
@@ -1000,9 +1000,9 @@
 	int status;
 	size_t post_read_size, post_read_idx;
 
-	if (pipe(fromCgi) != 0)
+	if (pipe(&fromCgi.rd) != 0)
 		return 0;
-	if (pipe(toCgi) != 0)
+	if (pipe(&toCgi.rd) != 0)
 		return 0;
 
 /*
@@ -1039,13 +1039,13 @@
 		if (server_socket > 1)
 			close(server_socket);
 
-		xmove_fd(toCgi[0], 0);  /* replace stdin with the pipe */
-		xmove_fd(fromCgi[1], 1);  /* replace stdout with the pipe */
-		close(fromCgi[0]);
-		close(fromCgi[1]);
+		xmove_fd(toCgi.rd, 0);  /* replace stdin with the pipe */
+		xmove_fd(fromCgi.wr, 1);  /* replace stdout with the pipe */
+		close(fromCgi.rd);
+		close(toCgi.wr);
 		/* Huh? User seeing stderr can be a security problem...
 		 * and if CGI really wants that, it can always dup2(1,2)...
-		 * dup2(fromCgi[1], 2); */
+		 * dup2(fromCgi.wr, 2); */
 
 		/*
 		 * Find PATH_INFO.
@@ -1175,10 +1175,10 @@
 	buf_count = 0;
 	post_read_size = 0;
 	post_read_idx = 0; /* for gcc */
-	inFd = fromCgi[0];
-	outFd = toCgi[1];
-	close(fromCgi[1]);
-	close(toCgi[0]);
+	inFd = fromCgi.rd;
+	outFd = toCgi.wr;
+	close(fromCgi.wr);
+	close(toCgi.rd);
 	signal(SIGPIPE, SIG_IGN);
 
 	while (1) {
@@ -1262,7 +1262,14 @@
 
 			/* Are we still buffering CGI output? */
 			if (buf_count >= 0) {
+				/* According to http://hoohoo.ncsa.uiuc.edu/cgi/out.html,
+				 * CGI scripts MUST send their own header terminated by
+				 * empty line, then data. That's why we have only one
+				 * <cr><lf> pair here. We will output "200 OK" line
+				 * if needed, but CGI still has to provide blank line
+				 * between header and body */
 				static const char HTTP_200[] = "HTTP/1.0 200 OK\r\n";
+
 				/* Must use safe_read, not full_read, because
 				 * CGI may output a few first bytes and then wait
 				 * for POSTDATA without closing stdout.




More information about the busybox-cvs mailing list