Ensure helper->next_request won't be used if pointing to empty string

Author: lpereira

src/lib/lwan-request.c

@@ -50,6 +50,8 @@
 #define HEADER_TERMINATOR_LEN (sizeof("\r\n") - 1)
 #define MIN_REQUEST_SIZE (sizeof("GET / HTTP/1.1\r\n\r\n") - 1)
 
+static const char *next_request_empty = "";
+
 enum lwan_read_finalizer {
     FINALIZER_DONE,
     FINALIZER_TRY_AGAIN,
@@ -933,32 +935,38 @@ static void save_to_corpus_for_fuzzing(struct lwan_value buffer)
 }
 #endif
 
-static enum lwan_http_status
-client_read(struct lwan_request *request,
-            struct lwan_value *buffer,
-            const size_t want_to_read,
-            enum lwan_read_finalizer (*finalizer)(const struct lwan_value *buffer,
-                                                  size_t want_to_read,
-                                                  const struct lwan_request *request,
-                                                  int n_packets))
+static enum lwan_http_status client_read(
+    struct lwan_request *request,
+    struct lwan_value *buffer,
+    const size_t want_to_read,
+    enum lwan_read_finalizer (*finalizer)(const struct lwan_value *buffer,
+                                          size_t want_to_read,
+                                          const struct lwan_request *request,
+                                          int n_packets))
 {
     struct lwan_request_parser_helper *helper = request->helper;
     int n_packets = 0;
 
     if (helper->next_request) {
-        const size_t next_request_len = (size_t)(helper->next_request - buffer->value);
-        size_t new_len;
-
-        if (__builtin_sub_overflow(buffer->len, next_request_len, &new_len)) {
+        if (UNLIKELY(helper->next_request == next_request_empty)) {
             helper->next_request = NULL;
-        } else if (new_len) {
-            /* FIXME: This memmove() could be eventually removed if a better
-             * stucture (maybe a ringbuffer, reading with readv(), and each
-             * pointer is coro_strdup() if they wrap around?) were used for
-             * the request buffer.  */
-            buffer->len = new_len;
-            memmove(buffer->value, helper->next_request, new_len);
-            goto try_to_finalize;
+        } else {
+            const size_t next_request_len =
+                (size_t)(helper->next_request - buffer->value);
+            size_t new_len;
+
+            if (__builtin_sub_overflow(buffer->len, next_request_len,
+                                       &new_len)) {
+                helper->next_request = NULL;
+            } else if (new_len) {
+                /* FIXME: This memmove() could be eventually removed if a better
+                 * stucture (maybe a ringbuffer, reading with readv(), and each
+                 * pointer is coro_strdup() if they wrap around?) were used for
+                 * the request buffer.  */
+                buffer->len = new_len;
+                memmove(buffer->value, helper->next_request, new_len);
+                goto try_to_finalize;
+            }
         }
     }
 
@@ -1289,7 +1297,7 @@ get_remaining_body_data_length(struct lwan_request *request,
     if (UNLIKELY((size_t)parsed_size >= max_size))
         return HTTP_TOO_LARGE;
     if (UNLIKELY(!parsed_size)) {
-        helper->next_request = "";
+        helper->next_request = (char *)next_request_empty;
         *total = *have = 0;
     } else {
         *total = (size_t)parsed_size;