Giters

dom96 / httpbeast

A highly performant, multi-threaded HTTP 1.1 server written in Nim.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Index out of bound on sending incomplete request method

greenfork opened this issue · comments

commented 
nim c -r tests/helloworld.nim
printf "G" | nc localhost 8080

Fails with

Listening on port 8080
/home/grfork/reps/httpbeast/src/httpbeast.nim(296) eventLoop
/home/grfork/reps/httpbeast/src/httpbeast.nim(203) processEvents
/home/grfork/reps/httpbeast/src/httpbeast.nim(115) slowHeadersCheck
/home/grfork/reps/httpbeast/src/httpbeast/parser.nim(10) parseHttpMethod
/home/grfork/.choosenim/toolchains/nim-1.4.0/lib/system/fatal.nim(49) sysFatal
Error: unhandled exception: index 1 not in 0 .. 0 [IndexDefect]
Error: execution of an external program failed: '/home/grfork/reps/httpbeast/tests/helloworld '
commented

parser.nim makes assumptions about the length of the data variable.
Compiled in debug mode it raises and crashes out, compiled with -d:debug it returns none(HttpMethod)
@dom96 : is this wanted? It might create a lot of DoS
Also, perhaps developers should be able to compile their own application in debug/release/danger mode based on their needs without the underlying web framework changing behavior. Httpbeast could have its own debugging flags if needed.

commented

I'm getting the same exception every few days on my website from a random request, but in fastHeadersCheck instead:

/root/.nimble/pkgs/jester-0.5.0/jester.nim(494) serve
/root/.nimble/pkgs/httpbeast-0.3.0/httpbeast.nim(484) run
/root/.nimble/pkgs/httpbeast-0.3.0/httpbeast.nim(337) eventLoop
/root/.nimble/pkgs/httpbeast-0.3.0/httpbeast.nim(133) processEvents
/root/.choosenim/toolchains/nim-1.6.0/lib/system.nim(2649) []
/root/.choosenim/toolchains/nim-1.6.0/lib/system/fatal.nim(53) sysFatal
Error: unhandled exception: index -1 not in 0 .. 0 [IndexDefect]

This is reproducible with echo "" instead of printf "G" in the original example.