Fix security and robustness issues in HTTP parsing and I/O

server.c

@@ -3,6 +3,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
+#include <errno.h>
 #include <time.h>
 #include <json-c/json.h>
 #include <curl/curl.h>
@@ -321,8 +322,10 @@ static void handle_stream_delta(sse_ctx_t *ctx, char *c, char *r,
 /* ------------------------------------------------------------------ */
 static size_t write_mem_cb(void *ptr, size_t sz, size_t nmemb, void *data) {
   strbuf *b = (strbuf *)data;
-  sb_append(b, ptr, sz * nmemb);
+  size_t n = sz * nmemb;
-  return sz * nmemb;
+  if (sz != 0 && n / sz != nmemb) return 0;
+  if (sb_append(b, ptr, n) != 0) return 0;
+  return n;
 }
 
 static size_t header_cb(char *buf, size_t sz, size_t nmemb, void *data) {
@@ -343,9 +346,11 @@ static size_t header_cb(char *buf, size_t sz, size_t nmemb, void *data) {
 
 static size_t write_sse_cb(void *ptr, size_t sz, size_t nmemb, void *data) {
   sse_ctx_t *ctx = (sse_ctx_t *)data;
-  sb_append(&ctx->line, ptr, sz * nmemb);
+  size_t n = sz * nmemb;
+  if (sz != 0 && n / sz != nmemb) return 0;
+  if (sb_append(&ctx->line, ptr, n) != 0) return 0;
   process_complete_lines(ctx);
-  return sz * nmemb;
+  return n;
 }
 
 /* ------------------------------------------------------------------ */
@@ -647,7 +652,14 @@ int parse_http_request(strbuf *buf, int fd, http_req_t *req, long max_body_bytes
       char *k = h;
       char *v = colon + 1;
       if (*v == ' ') v++;
-      if (iequals(k, "content-length")) req->content_length = atol(v);
+      if (iequals(k, "content-length")) {
+      errno = 0;
+      char *endp = NULL;
+      long long cl = strtoll(v, &endp, 10);
+      while (endp && (*endp == ' ' || *endp == '\t' || *endp == '\r' || *endp == '\n')) endp++;
+      if (errno != 0 || endp == v || (endp && *endp != '\0') || cl < 0) return -1;
+      req->content_length = (long)cl;
+    }
       else if (iequals(k, "content-type")) {
         strncpy(req->content_type, v, sizeof req->content_type - 1);
         req->content_type[sizeof req->content_type - 1] = 0;
@@ -661,6 +673,7 @@ int parse_http_request(strbuf *buf, int fd, http_req_t *req, long max_body_bytes
   }
 
   char *body_start = hlimit + 4;
+  if ((size_t)(body_start - buf->buf) > buf->len) return -1;
   size_t body_avail = buf->len - (size_t)(body_start - buf->buf);
   if (req->content_length < 0) return -1;
   if (max_body_bytes > 0 && req->content_length > max_body_bytes) return -2;
@@ -673,7 +686,7 @@ int parse_http_request(strbuf *buf, int fd, http_req_t *req, long max_body_bytes
     if (got > 0) memcpy(req->body, body_start, got);
     while (got < (size_t)req->content_length) {
       ssize_t n = read(fd, req->body + got, (size_t)req->content_length - got);
-      if (n <= 0) break;
+      if (n <= 0) { free(req->body); req->body = NULL; return -1; }
       got += (size_t)n;
     }
     req->body[got] = 0;
@@ -705,6 +718,8 @@ void handle_connection(int fd, const config_t *cfg) {
     if (prc == -2)
       send_simple(fd, 413, "Payload Too Large",
                   "Request body exceeds the maximum allowed size");
+    else
+      send_simple(fd, 400, "Bad Request", "Malformed HTTP request");
     http_req_free(&req);
     sb_free(&reqbuf);
     return;

util.c

@@ -3,6 +3,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
+#include <time.h>
 #include <errno.h>
 #include <stdint.h>
 
@@ -60,13 +61,17 @@ void generate_uuid(char out[37]) {
   unsigned char b[16];
   size_t i;
   FILE *f = fopen("/dev/urandom", "rb");
+  size_t got = 0;
   if (f) {
-    size_t got = fread(b, 1, 16, f);
+    while (got < 16) {
-    fclose(f);
+      size_t r = fread(b + got, 1, 16 - got, f);
-    if (got != 16) {
+      if (r == 0) break;
-      for (i = 0; i < 16; i++) b[i] = (unsigned char)(rand() & 0xff);
+      got += r;
     }
-  } else {
+    fclose(f);
+  }
+  if (got != 16) {
+    srand((unsigned int)(time(NULL) ^ (unsigned int)getpid()));
     for (i = 0; i < 16; i++) b[i] = (unsigned char)(rand() & 0xff);
   }
   b[6] = (unsigned char)((b[6] & 0x0f) | 0x40);