Must really be safe_read(), not full_read()? (was: [PATCH] fix httpd lockup in cgi POSTs)

[Denis Vlasenko]

On Monday 12 February 2007 22:17, Paul Albrecht wrote:
> On Mon, 2007-02-12 at 21:52 +0100, Denis Vlasenko wrote: 
> > On Monday 12 February 2007 16:25, Paul Albrecht wrote:
> > > 
> > > Reverting the code back to using safe_read doesn't work if you don't fix
> > > the way the first line is handled because you're not guaranteed a full
> > > line with the safe_read.
> > > 
> > > You can verify this by writing a cgi program which redirects to another
> > > location.
> > 
> > Testcase, please?
> 
> I have already given you an example in a previous message, but here it
> is again: 
> 
> echo -en "HTTP/1.0 302 Found\r\n"
> echo -en "Location: http://www.busybox.net\r\n"
> echo -en "\r\n"

#!/bin/sh
echo -en "HTTP/1.0 302 Found\r\n"
echo -en "Location: http://www.busybox.net\r\n"
echo -en "\r\n"

Works for me 

> I think the busybox httpd server cgi program interaction is obviously
> idiosyncratic in that the server doesn't parse returned headers and
> mucks with the status line.
> 
> I'm not really complaining, but however you expect the httpd server and
> cgi program to interact to get a valid http response back to a user
> should work.

bbox applets usually start small and then add features / fix bugs
in the order of severity.

> If you're going to write the status line if you don't get one back from
> the cgi program you should do that and you're not doing that because
> you're using an unbuffered read to get at least four characters of the
> first line of cgi output and that doesn't always work.

I will gladly take good patch which does said buffering.

> > Yes, this will even handle the case when CGI writes "HTT" and
> > "P/1.0 200 OK" separately.
> 
> That's not the problem. For example, if a cgi program writes:
> 
> echo -en "HTTP/1.0 302 Found\r\n"
> 
> The busybox httpd server has no right to assume it's got more than a
> byte of data when a safe_read completes with good status because its
> input isn't buffered. 

Sorry, I don't understand this part. If cgi writes "HTTP/1.0 302 Found\r\n"
using one write syscall, httpd will read the same number of bytes (not less).
--
vda