http_parser_create: 44| 422|{ 45| 422| parser->hdr_value_start = NULL; 46| 422| parser->hdr_value_end = NULL; 47| 422| parser->http_major = -1; 48| 422| parser->http_minor = -1; 49| 422| parser->hdr_name = NULL; 50| 422| parser->hdr_name_idx = 0; 51| 422|} http_parse_header_line: 228| 422|{ 229| 422| char c; 230| 422| unsigned char ch; 231| 422| const char *p = *bufp; 232| 422| const char *header_name_start = p; 233| 422| prsr->hdr_name_idx = 0; 234| | 235| 422| enum { 236| 422| sw_start = 0, 237| 422| skip_status_line, 238| 422| skipped_status_line_almost_done, 239| 422| sw_name, 240| 422| sw_space_before_value, 241| 422| sw_value, 242| 422| sw_space_after_value, 243| 422| sw_almost_done, 244| 422| sw_header_almost_done 245| 422| } state = sw_start; 246| | 247| | /* 248| | * The last '\0' is not needed 249| | * because string is zero terminated 250| | */ 251| 422| static char lowcase[] = 252| 422| "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" 253| 422| "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0-\0\0" "0123456789" 254| 422| "\0\0\0\0\0\0\0abcdefghijklmnopqrstuvwxyz\0\0\0\0_\0" 255| 422| "abcdefghijklmnopqrstuvwxyz\0\0\0\0\0\0\0\0\0\0\0\0\0\0" 256| 422| "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" 257| 422| "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" 258| 422| "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" 259| 422| "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" 260| 422| "\0\0\0\0\0\0\0\0\0\0"; 261| | 262| 5.24M| for (; p < end_buf; p++) { ------------------ | Branch (262:9): [True: 5.24M, False: 391] ------------------ 263| 5.24M| ch = *p; 264| 5.24M| switch (state) { ------------------ | Branch (264:11): [True: 0, False: 5.24M] ------------------ 265| | /* first char */ 266| 548| case sw_start: ------------------ | Branch (266:3): [True: 548, False: 5.24M] ------------------ 267| 548| switch (ch) { 268| 12| case CR: ------------------ | | 35| 12|#define CR (unsigned char) '\r' ------------------ | Branch (268:4): [True: 12, False: 536] ------------------ 269| 12| prsr->hdr_value_end = p; 270| 12| state = sw_header_almost_done; 271| 12| break; 272| 1| case LF: ------------------ | | 34| 1|#define LF (unsigned char) '\n' ------------------ | Branch (272:4): [True: 1, False: 547] ------------------ 273| 1| prsr->hdr_value_end = p; 274| 1| goto header_done; 275| 535| default: ------------------ | Branch (275:4): [True: 535, False: 13] ------------------ 276| 535| state = sw_name; 277| 535| c = lowcase[ch]; 278| 535| if (c != 0) { ------------------ | Branch (278:9): [True: 443, False: 92] ------------------ 279| 443| prsr->hdr_name[0] = c; 280| 443| prsr->hdr_name_idx = 1; 281| 443| break; 282| 443| } 283| 92| if (ch == '\0') { ------------------ | Branch (283:9): [True: 1, False: 91] ------------------ 284| 1| return HTTP_PARSE_INVALID; 285| 1| } 286| 91| break; 287| 548| } 288| 546| break; 289| 1.94k| case skip_status_line: ------------------ | Branch (289:3): [True: 1.94k, False: 5.24M] ------------------ 290| 1.94k| switch (ch) { 291| 2| case LF: ------------------ | | 34| 2|#define LF (unsigned char) '\n' ------------------ | Branch (291:4): [True: 2, False: 1.94k] ------------------ 292| 2| goto skipped_status; 293| 3| case CR: ------------------ | | 35| 3|#define CR (unsigned char) '\r' ------------------ | Branch (293:4): [True: 3, False: 1.94k] ------------------ 294| 3| state = skipped_status_line_almost_done; 295| 1.94k| default: ------------------ | Branch (295:4): [True: 1.94k, False: 5] ------------------ 296| 1.94k| break; 297| 1.94k| } 298| 1.94k| break; 299| 1.94k| case skipped_status_line_almost_done: ------------------ | Branch (299:3): [True: 1, False: 5.24M] ------------------ 300| 1| switch (ch) { 301| 1| case LF: ------------------ | | 34| 1|#define LF (unsigned char) '\n' ------------------ | Branch (301:4): [True: 1, False: 0] ------------------ 302| 1| goto skipped_status; 303| 0| case CR: ------------------ | | 35| 0|#define CR (unsigned char) '\r' ------------------ | Branch (303:4): [True: 0, False: 1] ------------------ 304| 0| break; 305| 0| default: ------------------ | Branch (305:4): [True: 0, False: 1] ------------------ 306| 0| return HTTP_PARSE_INVALID; 307| 1| } 308| 0| break; 309| | /* http_header name */ 310| 5.24M| case sw_name: ------------------ | Branch (310:3): [True: 5.24M, False: 4.11k] ------------------ 311| 5.24M| c = lowcase[ch]; 312| 5.24M| if (c != 0) { ------------------ | Branch (312:8): [True: 4.06M, False: 1.17M] ------------------ 313| 4.06M| if (prsr->hdr_name_idx < max_hname_len) { ------------------ | Branch (313:9): [True: 4.06M, False: 0] ------------------ 314| 4.06M| prsr->hdr_name[prsr->hdr_name_idx] = c; 315| 4.06M| prsr->hdr_name_idx++; 316| 4.06M| } 317| 4.06M| break; 318| 4.06M| } 319| 1.17M| if (ch == ':') { ------------------ | Branch (319:8): [True: 51, False: 1.17M] ------------------ 320| 51| state = sw_space_before_value; 321| 51| break; 322| 51| } 323| 1.17M| if (ch == CR) { ------------------ | | 35| 1.17M|#define CR (unsigned char) '\r' ------------------ | Branch (323:8): [True: 12, False: 1.17M] ------------------ 324| 12| prsr->hdr_value_start = p; 325| 12| prsr->hdr_value_end = p; 326| 12| state = sw_almost_done; 327| 12| break; 328| 12| } 329| 1.17M| if (ch == LF) { ------------------ | | 34| 1.17M|#define LF (unsigned char) '\n' ------------------ | Branch (329:8): [True: 1, False: 1.17M] ------------------ 330| 1| prsr->hdr_value_start = p; 331| 1| prsr->hdr_value_end = p; 332| 1| goto done; 333| 1| } 334| | /* handle "HTTP/1.1 ..." lines */ 335| 1.17M| if (ch == '/' && p - header_name_start == 4 && ------------------ | Branch (335:8): [True: 1.16M, False: 10.3k] | Branch (335:21): [True: 257, False: 1.16M] ------------------ 336| 1.17M| strncmp(header_name_start, "HTTP", 4) == 0) { ------------------ | Branch (336:5): [True: 214, False: 43] ------------------ 337| 214| int rc = http_parse_status_line(prsr, 338| 214| &header_name_start, 339| 214| end_buf); 340| 214| if (rc == HTTP_PARSE_INVALID) { ------------------ | Branch (340:9): [True: 126, False: 88] ------------------ 341| 126| prsr->http_minor = -1; 342| 126| prsr->http_major = -1; 343| 126| state = sw_start; 344| 126| } else { 345| | /* Skip it till end of line. */ 346| 88| state = skip_status_line; 347| 88| } 348| 214| break; 349| 214| } 350| 1.17M| if (ch == '\0') ------------------ | Branch (350:8): [True: 5, False: 1.17M] ------------------ 351| 5| return HTTP_PARSE_INVALID; 352| 1.17M| break; 353| | /* space* before http_header value */ 354| 1.17M| case sw_space_before_value: ------------------ | Branch (354:3): [True: 236, False: 5.24M] ------------------ 355| 236| switch (ch) { 356| 194| case ' ': ------------------ | Branch (356:4): [True: 194, False: 42] ------------------ 357| 194| break; 358| 1| case CR: ------------------ | | 35| 1|#define CR (unsigned char) '\r' ------------------ | Branch (358:4): [True: 1, False: 235] ------------------ 359| 1| prsr->hdr_value_start = p; 360| 1| prsr->hdr_value_end = p; 361| 1| state = sw_almost_done; 362| 1| break; 363| 1| case LF: ------------------ | | 34| 1|#define LF (unsigned char) '\n' ------------------ | Branch (363:4): [True: 1, False: 235] ------------------ 364| 1| prsr->hdr_value_start = p; 365| 1| prsr->hdr_value_end = p; 366| 1| goto done; 367| 1| case '\0': ------------------ | Branch (367:4): [True: 1, False: 235] ------------------ 368| 1| return HTTP_PARSE_INVALID; 369| 39| default: ------------------ | Branch (369:4): [True: 39, False: 197] ------------------ 370| 39| prsr->hdr_value_start = p; 371| 39| state = sw_value; 372| 39| break; 373| 236| } 374| 234| break; 375| | 376| | /* http_header value */ 377| 596| case sw_value: ------------------ | Branch (377:3): [True: 596, False: 5.24M] ------------------ 378| 596| switch (ch) { ------------------ | Branch (378:12): [True: 194, False: 402] ------------------ 379| 399| case ' ': ------------------ | Branch (379:4): [True: 399, False: 197] ------------------ 380| 399| prsr->hdr_value_end = p; 381| 399| state = sw_space_after_value; 382| 399| break; 383| 1| case CR: ------------------ | | 35| 1|#define CR (unsigned char) '\r' ------------------ | Branch (383:4): [True: 1, False: 595] ------------------ 384| 1| prsr->hdr_value_end = p; 385| 1| state = sw_almost_done; 386| 1| break; 387| 1| case LF: ------------------ | | 34| 1|#define LF (unsigned char) '\n' ------------------ | Branch (387:4): [True: 1, False: 595] ------------------ 388| 1| prsr->hdr_value_end = p; 389| 1| goto done; 390| 1| case '\0': ------------------ | Branch (390:4): [True: 1, False: 595] ------------------ 391| 1| return HTTP_PARSE_INVALID; 392| 596| } 393| 594| break; 394| | /* space* before end of http_header line */ 395| 594| case sw_space_after_value: ------------------ | Branch (395:3): [True: 577, False: 5.24M] ------------------ 396| 577| switch (ch) { 397| 194| case ' ': ------------------ | Branch (397:4): [True: 194, False: 383] ------------------ 398| 194| break; 399| 1| case CR: ------------------ | | 35| 1|#define CR (unsigned char) '\r' ------------------ | Branch (399:4): [True: 1, False: 576] ------------------ 400| 1| state = sw_almost_done; 401| 1| break; 402| 1| case LF: ------------------ | | 34| 1|#define LF (unsigned char) '\n' ------------------ | Branch (402:4): [True: 1, False: 576] ------------------ 403| 1| goto done; 404| 1| case '\0': ------------------ | Branch (404:4): [True: 1, False: 576] ------------------ 405| 1| return HTTP_PARSE_INVALID; 406| 380| default: ------------------ | Branch (406:4): [True: 380, False: 197] ------------------ 407| 380| state = sw_value; 408| 380| break; 409| 577| } 410| 575| break; 411| | /* end of http_header line */ 412| 575| case sw_almost_done: ------------------ | Branch (412:3): [True: 197, False: 5.24M] ------------------ 413| 197| switch (ch) { 414| 1| case LF: ------------------ | | 34| 1|#define LF (unsigned char) '\n' ------------------ | Branch (414:4): [True: 1, False: 196] ------------------ 415| 1| goto done; 416| 194| case CR: ------------------ | | 35| 194|#define CR (unsigned char) '\r' ------------------ | Branch (416:4): [True: 194, False: 3] ------------------ 417| 194| break; 418| 2| default: ------------------ | Branch (418:4): [True: 2, False: 195] ------------------ 419| 2| return HTTP_PARSE_INVALID; 420| 197| } 421| 194| break; 422| | /* end of http_header */ 423| 194| case sw_header_almost_done: ------------------ | Branch (423:3): [True: 11, False: 5.24M] ------------------ 424| 11| if (ch == LF) ------------------ | | 34| 11|#define LF (unsigned char) '\n' ------------------ | Branch (424:8): [True: 1, False: 10] ------------------ 425| 1| goto header_done; 426| 10| else 427| 10| return HTTP_PARSE_INVALID; 428| 5.24M| } 429| 5.24M| } 430| | 431| 394|skipped_status: 432| 394| *bufp = p + 1; 433| 394| return HTTP_PARSE_CONTINUE; 434| | 435| 5|done: 436| 5| *bufp = p + 1; 437| 5| return HTTP_PARSE_OK; 438| | 439| 2|header_done: 440| 2| *bufp = p + 1; 441| 2| return HTTP_PARSE_DONE; 442| 422|} http_parser.c:http_parse_status_line: 59| 214|{ 60| 214| char ch; 61| 214| const char *p = *bufp; 62| 214| enum { 63| 214| sw_start = 0, 64| 214| sw_H, 65| 214| sw_HT, 66| 214| sw_HTT, 67| 214| sw_HTTP, 68| 214| sw_first_major_digit, 69| 214| sw_major_digit, 70| 214| sw_first_minor_digit, 71| 214| sw_minor_digit, 72| 214| sw_status, 73| 214| sw_space_after_status, 74| 214| sw_status_text, 75| 214| sw_almost_done 76| 214| } state; 77| | 78| 214| state = sw_start; 79| 214| int status_count = 0; 80| 3.45k| for (;p < end_buf; p++) { ------------------ | Branch (80:8): [True: 3.36k, False: 85] ------------------ 81| 3.36k| ch = *p; 82| 3.36k| switch (state) { ------------------ | Branch (82:11): [True: 0, False: 3.36k] ------------------ 83| | /* "HTTP/" */ 84| 214| case sw_start: ------------------ | Branch (84:3): [True: 214, False: 3.15k] ------------------ 85| 214| if (ch == 'H') ------------------ | Branch (85:8): [True: 214, False: 0] ------------------ 86| 214| state = sw_H; 87| 0| else 88| 0| return HTTP_PARSE_INVALID; 89| 214| break; 90| 214| case sw_H: ------------------ | Branch (90:3): [True: 214, False: 3.15k] ------------------ 91| 214| if (ch == 'T') ------------------ | Branch (91:8): [True: 214, False: 0] ------------------ 92| 214| state = sw_HT; 93| 0| else 94| 0| return HTTP_PARSE_INVALID; 95| 214| break; 96| 214| case sw_HT: ------------------ | Branch (96:3): [True: 214, False: 3.15k] ------------------ 97| 214| if (ch == 'T') ------------------ | Branch (97:8): [True: 214, False: 0] ------------------ 98| 214| state = sw_HTT; 99| 0| else 100| 0| return HTTP_PARSE_INVALID; 101| 214| break; 102| 214| case sw_HTT: ------------------ | Branch (102:3): [True: 214, False: 3.15k] ------------------ 103| 214| if (ch == 'P') ------------------ | Branch (103:8): [True: 214, False: 0] ------------------ 104| 214| state = sw_HTTP; 105| 0| else 106| 0| return HTTP_PARSE_INVALID; 107| 214| break; 108| 214| case sw_HTTP: ------------------ | Branch (108:3): [True: 214, False: 3.15k] ------------------ 109| 214| if (ch == '/') ------------------ | Branch (109:8): [True: 214, False: 0] ------------------ 110| 214| state = sw_first_major_digit; 111| 0| else 112| 0| return HTTP_PARSE_INVALID; 113| 214| break; 114| | /* The first digit of major HTTP version */ 115| 214| case sw_first_major_digit: ------------------ | Branch (115:3): [True: 213, False: 3.15k] ------------------ 116| 213| if (ch < '1' || ch > '9') { ------------------ | Branch (116:8): [True: 16, False: 197] | Branch (116:20): [True: 5, False: 192] ------------------ 117| 21| return HTTP_PARSE_INVALID; 118| 21| } 119| 192| parser->http_major = ch - '0'; 120| 192| state = sw_major_digit; 121| 192| break; 122| | /* The major HTTP version or dot */ 123| 207| case sw_major_digit: ------------------ | Branch (123:3): [True: 207, False: 3.16k] ------------------ 124| 207| if (ch == '.') { ------------------ | Branch (124:8): [True: 68, False: 139] ------------------ 125| 68| state = sw_first_minor_digit; 126| 68| break; 127| 68| } 128| 139| if (ch == ' ') { ------------------ | Branch (128:8): [True: 67, False: 72] ------------------ 129| 67| parser->http_minor = 0; 130| 67| state = sw_status; 131| 67| break; 132| 67| } 133| 72| if (ch < '0' || ch > '9') { ------------------ | Branch (133:8): [True: 24, False: 48] | Branch (133:20): [True: 7, False: 41] ------------------ 134| 31| return HTTP_PARSE_INVALID; 135| 31| } 136| 41| if (parser->http_major > 99) { ------------------ | Branch (136:8): [True: 4, False: 37] ------------------ 137| 4| return HTTP_PARSE_INVALID; 138| 4| } 139| 37| parser->http_major = parser->http_major * 10 140| 37| + (ch - '0'); 141| 37| break; 142| | /* The first digit of minor HTTP version */ 143| 67| case sw_first_minor_digit: ------------------ | Branch (143:3): [True: 67, False: 3.30k] ------------------ 144| 67| if (ch < '0' || ch > '9') { ------------------ | Branch (144:8): [True: 13, False: 54] | Branch (144:20): [True: 3, False: 51] ------------------ 145| 16| return HTTP_PARSE_INVALID; 146| 16| } 147| 51| parser->http_minor = ch - '0'; 148| 51| state = sw_minor_digit; 149| 51| break; 150| | /* 151| | * The minor HTTP version or 152| | * the end of the request line 153| | */ 154| 249| case sw_minor_digit: ------------------ | Branch (154:3): [True: 249, False: 3.12k] ------------------ 155| 249| if (ch == ' ') { ------------------ | Branch (155:8): [True: 1, False: 248] ------------------ 156| 1| state = sw_status; 157| 1| break; 158| 1| } 159| 248| if (ch < '0' || ch > '9') { ------------------ | Branch (159:8): [True: 19, False: 229] | Branch (159:20): [True: 5, False: 224] ------------------ 160| 24| return HTTP_PARSE_INVALID; 161| 24| } 162| 224| if (parser->http_minor > 99) { ------------------ | Branch (162:8): [True: 3, False: 221] ------------------ 163| 3| return HTTP_PARSE_INVALID; 164| 3| } 165| 221| parser->http_minor = parser->http_minor * 10 166| 221| + (ch - '0'); 167| 221| break; 168| | /* HTTP status code */ 169| 314| case sw_status: ------------------ | Branch (169:3): [True: 314, False: 3.05k] ------------------ 170| 314| if (ch == ' ') { ------------------ | Branch (170:8): [True: 203, False: 111] ------------------ 171| 203| break; 172| 203| } 173| 111| if (ch < '0' || ch > '9') { ------------------ | Branch (173:8): [True: 21, False: 90] | Branch (173:20): [True: 4, False: 86] ------------------ 174| 25| return HTTP_PARSE_INVALID; 175| 25| } 176| 86| if (++status_count == 3) { ------------------ | Branch (176:8): [True: 26, False: 60] ------------------ 177| 26| state = sw_space_after_status; 178| 26| } 179| 86| break; 180| | /* Space or end of line */ 181| 25| case sw_space_after_status: ------------------ | Branch (181:3): [True: 25, False: 3.34k] ------------------ 182| 25| switch (ch) { 183| 13| case ' ': ------------------ | Branch (183:4): [True: 13, False: 12] ------------------ 184| 13| state = sw_status_text; 185| 13| break; 186| 7| case '.': ------------------ | Branch (186:4): [True: 7, False: 18] ------------------ 187| | /* IIS may send 403.1, 403.2, etc */ 188| 7| state = sw_status_text; 189| 7| break; 190| 3| case CR: ------------------ | | 35| 3|#define CR (unsigned char) '\r' ------------------ | Branch (190:4): [True: 3, False: 22] ------------------ 191| 3| state = sw_almost_done; 192| 3| break; 193| 1| case LF: ------------------ | | 34| 1|#define LF (unsigned char) '\n' ------------------ | Branch (193:4): [True: 1, False: 24] ------------------ 194| 1| goto done; 195| 1| default: ------------------ | Branch (195:4): [True: 1, False: 24] ------------------ 196| 1| return HTTP_PARSE_INVALID; 197| 25| } 198| 23| break; 199| | /* Any text until end of line */ 200| 1.22k| case sw_status_text: ------------------ | Branch (200:3): [True: 1.22k, False: 2.14k] ------------------ 201| 1.22k| switch (ch) { ------------------ | Branch (201:12): [True: 1.22k, False: 2] ------------------ 202| 1| case CR: ------------------ | | 35| 1|#define CR (unsigned char) '\r' ------------------ | Branch (202:4): [True: 1, False: 1.22k] ------------------ 203| 1| state = sw_almost_done; 204| 1| break; 205| 1| case LF: ------------------ | | 34| 1|#define LF (unsigned char) '\n' ------------------ | Branch (205:4): [True: 1, False: 1.22k] ------------------ 206| 1| goto done; 207| 1.22k| } 208| 1.22k| break; 209| | 210| | /* End of status line */ 211| 1.22k| case sw_almost_done: ------------------ | Branch (211:3): [True: 2, False: 3.36k] ------------------ 212| 2| switch (ch) { 213| 1| case LF: ------------------ | | 34| 1|#define LF (unsigned char) '\n' ------------------ | Branch (213:4): [True: 1, False: 1] ------------------ 214| 1| goto done; 215| 1| default: ------------------ | Branch (215:4): [True: 1, False: 1] ------------------ 216| 1| return HTTP_PARSE_INVALID; 217| 2| } 218| 3.36k| } 219| 3.36k| } 220| 88|done: 221| 88| *bufp = p + 1; 222| 88| return HTTP_PARSE_OK; 223| 214|} LLVMFuzzerTestOneInput: 7| 422|{ 8| 422| struct http_parser parser; 9| 422| const char *buf = (char *)data; 10| 422| http_parser_create(&parser); 11| 422| parser.hdr_name = (char *)calloc(size, sizeof(char)); 12| 422| if (parser.hdr_name == NULL) ------------------ | Branch (12:6): [True: 0, False: 422] ------------------ 13| 0| return 0; 14| 422| const char *end_buf = buf + size; 15| 422| http_parse_header_line(&parser, &buf, end_buf, size); 16| 422| free(parser.hdr_name); 17| | 18| 422| return 0; 19| 422|}