http_parser_create: 44| 437|{ 45| 437| parser->hdr_value_start = NULL; 46| 437| parser->hdr_value_end = NULL; 47| 437| parser->http_major = -1; 48| 437| parser->http_minor = -1; 49| 437| parser->hdr_name = NULL; 50| 437| parser->hdr_name_idx = 0; 51| 437|} http_parse_header_line: 228| 437|{ 229| 437| char c; 230| 437| unsigned char ch; 231| 437| const char *p = *bufp; 232| 437| const char *header_name_start = p; 233| 437| prsr->hdr_name_idx = 0; 234| | 235| 437| enum { 236| 437| sw_start = 0, 237| 437| skip_status_line, 238| 437| skipped_status_line_almost_done, 239| 437| sw_name, 240| 437| sw_space_before_value, 241| 437| sw_value, 242| 437| sw_space_after_value, 243| 437| sw_almost_done, 244| 437| sw_header_almost_done 245| 437| } state = sw_start; 246| | 247| | /* 248| | * The last '\0' is not needed 249| | * because string is zero terminated 250| | */ 251| 437| static char lowcase[] = 252| 437| "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" 253| 437| "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0-\0\0" "0123456789" 254| 437| "\0\0\0\0\0\0\0abcdefghijklmnopqrstuvwxyz\0\0\0\0_\0" 255| 437| "abcdefghijklmnopqrstuvwxyz\0\0\0\0\0\0\0\0\0\0\0\0\0\0" 256| 437| "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" 257| 437| "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" 258| 437| "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" 259| 437| "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" 260| 437| "\0\0\0\0\0\0\0\0\0\0"; 261| | 262| 6.29M| for (; p < end_buf; p++) { ------------------ | Branch (262:9): [True: 6.29M, False: 409] ------------------ 263| 6.29M| ch = *p; 264| 6.29M| switch (state) { ------------------ | Branch (264:11): [True: 0, False: 6.29M] ------------------ 265| | /* first char */ 266| 568| case sw_start: ------------------ | Branch (266:3): [True: 568, False: 6.29M] ------------------ 267| 568| switch (ch) { 268| 12| case CR: ------------------ | | 35| 12|#define CR (unsigned char) '\r' ------------------ | Branch (268:4): [True: 12, False: 556] ------------------ 269| 12| prsr->hdr_value_end = p; 270| 12| state = sw_header_almost_done; 271| 12| break; 272| 1| case LF: ------------------ | | 34| 1|#define LF (unsigned char) '\n' ------------------ | Branch (272:4): [True: 1, False: 567] ------------------ 273| 1| prsr->hdr_value_end = p; 274| 1| goto header_done; 275| 555| default: ------------------ | Branch (275:4): [True: 555, False: 13] ------------------ 276| 555| state = sw_name; 277| 555| c = lowcase[ch]; 278| 555| if (c != 0) { ------------------ | Branch (278:9): [True: 443, False: 112] ------------------ 279| 443| prsr->hdr_name[0] = c; 280| 443| prsr->hdr_name_idx = 1; 281| 443| break; 282| 443| } 283| 112| if (ch == '\0') { ------------------ | Branch (283:9): [True: 1, False: 111] ------------------ 284| 1| return HTTP_PARSE_INVALID; 285| 1| } 286| 111| break; 287| 568| } 288| 566| break; 289| 1.97k| case skip_status_line: ------------------ | Branch (289:3): [True: 1.97k, False: 6.29M] ------------------ 290| 1.97k| switch (ch) { 291| 2| case LF: ------------------ | | 34| 2|#define LF (unsigned char) '\n' ------------------ | Branch (291:4): [True: 2, False: 1.97k] ------------------ 292| 2| goto skipped_status; 293| 4| case CR: ------------------ | | 35| 4|#define CR (unsigned char) '\r' ------------------ | Branch (293:4): [True: 4, False: 1.97k] ------------------ 294| 4| state = skipped_status_line_almost_done; 295| 1.97k| default: ------------------ | Branch (295:4): [True: 1.97k, False: 6] ------------------ 296| 1.97k| break; 297| 1.97k| } 298| 1.97k| break; 299| 1.97k| case skipped_status_line_almost_done: ------------------ | Branch (299:3): [True: 1, False: 6.29M] ------------------ 300| 1| switch (ch) { 301| 1| case LF: ------------------ | | 34| 1|#define LF (unsigned char) '\n' ------------------ | Branch (301:4): [True: 1, False: 0] ------------------ 302| 1| goto skipped_status; 303| 0| case CR: ------------------ | | 35| 0|#define CR (unsigned char) '\r' ------------------ | Branch (303:4): [True: 0, False: 1] ------------------ 304| 0| break; 305| 0| default: ------------------ | Branch (305:4): [True: 0, False: 1] ------------------ 306| 0| return HTTP_PARSE_INVALID; 307| 1| } 308| 0| break; 309| | /* http_header name */ 310| 6.29M| case sw_name: ------------------ | Branch (310:3): [True: 6.29M, False: 4.17k] ------------------ 311| 6.29M| c = lowcase[ch]; 312| 6.29M| if (c != 0) { ------------------ | Branch (312:8): [True: 3.43M, False: 2.85M] ------------------ 313| 3.43M| if (prsr->hdr_name_idx < max_hname_len) { ------------------ | Branch (313:9): [True: 3.43M, False: 0] ------------------ 314| 3.43M| prsr->hdr_name[prsr->hdr_name_idx] = c; 315| 3.43M| prsr->hdr_name_idx++; 316| 3.43M| } 317| 3.43M| break; 318| 3.43M| } 319| 2.85M| if (ch == ':') { ------------------ | Branch (319:8): [True: 53, False: 2.85M] ------------------ 320| 53| state = sw_space_before_value; 321| 53| break; 322| 53| } 323| 2.85M| if (ch == CR) { ------------------ | | 35| 2.85M|#define CR (unsigned char) '\r' ------------------ | Branch (323:8): [True: 13, False: 2.85M] ------------------ 324| 13| prsr->hdr_value_start = p; 325| 13| prsr->hdr_value_end = p; 326| 13| state = sw_almost_done; 327| 13| break; 328| 13| } 329| 2.85M| if (ch == LF) { ------------------ | | 34| 2.85M|#define LF (unsigned char) '\n' ------------------ | Branch (329:8): [True: 1, False: 2.85M] ------------------ 330| 1| prsr->hdr_value_start = p; 331| 1| prsr->hdr_value_end = p; 332| 1| goto done; 333| 1| } 334| | /* handle "HTTP/1.1 ..." lines */ 335| 2.85M| if (ch == '/' && p - header_name_start == 4 && ------------------ | Branch (335:8): [True: 2.31M, False: 540k] | Branch (335:21): [True: 273, False: 2.31M] ------------------ 336| 2.85M| strncmp(header_name_start, "HTTP", 4) == 0) { ------------------ | Branch (336:5): [True: 227, False: 46] ------------------ 337| 227| int rc = http_parse_status_line(prsr, 338| 227| &header_name_start, 339| 227| end_buf); 340| 227| if (rc == HTTP_PARSE_INVALID) { ------------------ | Branch (340:9): [True: 131, False: 96] ------------------ 341| 131| prsr->http_minor = -1; 342| 131| prsr->http_major = -1; 343| 131| state = sw_start; 344| 131| } else { 345| | /* Skip it till end of line. */ 346| 96| state = skip_status_line; 347| 96| } 348| 227| break; 349| 227| } 350| 2.85M| if (ch == '\0') ------------------ | Branch (350:8): [True: 2, False: 2.85M] ------------------ 351| 2| return HTTP_PARSE_INVALID; 352| 2.85M| break; 353| | /* space* before http_header value */ 354| 2.85M| case sw_space_before_value: ------------------ | Branch (354:3): [True: 237, False: 6.29M] ------------------ 355| 237| switch (ch) { 356| 194| case ' ': ------------------ | Branch (356:4): [True: 194, False: 43] ------------------ 357| 194| break; 358| 1| case CR: ------------------ | | 35| 1|#define CR (unsigned char) '\r' ------------------ | Branch (358:4): [True: 1, False: 236] ------------------ 359| 1| prsr->hdr_value_start = p; 360| 1| prsr->hdr_value_end = p; 361| 1| state = sw_almost_done; 362| 1| break; 363| 1| case LF: ------------------ | | 34| 1|#define LF (unsigned char) '\n' ------------------ | Branch (363:4): [True: 1, False: 236] ------------------ 364| 1| prsr->hdr_value_start = p; 365| 1| prsr->hdr_value_end = p; 366| 1| goto done; 367| 1| case '\0': ------------------ | Branch (367:4): [True: 1, False: 236] ------------------ 368| 1| return HTTP_PARSE_INVALID; 369| 40| default: ------------------ | Branch (369:4): [True: 40, False: 197] ------------------ 370| 40| prsr->hdr_value_start = p; 371| 40| state = sw_value; 372| 40| break; 373| 237| } 374| 235| break; 375| | 376| | /* http_header value */ 377| 597| case sw_value: ------------------ | Branch (377:3): [True: 597, False: 6.29M] ------------------ 378| 597| switch (ch) { ------------------ | Branch (378:12): [True: 194, False: 403] ------------------ 379| 400| case ' ': ------------------ | Branch (379:4): [True: 400, False: 197] ------------------ 380| 400| prsr->hdr_value_end = p; 381| 400| state = sw_space_after_value; 382| 400| break; 383| 1| case CR: ------------------ | | 35| 1|#define CR (unsigned char) '\r' ------------------ | Branch (383:4): [True: 1, False: 596] ------------------ 384| 1| prsr->hdr_value_end = p; 385| 1| state = sw_almost_done; 386| 1| break; 387| 1| case LF: ------------------ | | 34| 1|#define LF (unsigned char) '\n' ------------------ | Branch (387:4): [True: 1, False: 596] ------------------ 388| 1| prsr->hdr_value_end = p; 389| 1| goto done; 390| 1| case '\0': ------------------ | Branch (390:4): [True: 1, False: 596] ------------------ 391| 1| return HTTP_PARSE_INVALID; 392| 597| } 393| 595| break; 394| | /* space* before end of http_header line */ 395| 595| case sw_space_after_value: ------------------ | Branch (395:3): [True: 589, False: 6.29M] ------------------ 396| 589| switch (ch) { 397| 206| case ' ': ------------------ | Branch (397:4): [True: 206, False: 383] ------------------ 398| 206| break; 399| 1| case CR: ------------------ | | 35| 1|#define CR (unsigned char) '\r' ------------------ | Branch (399:4): [True: 1, False: 588] ------------------ 400| 1| state = sw_almost_done; 401| 1| break; 402| 1| case LF: ------------------ | | 34| 1|#define LF (unsigned char) '\n' ------------------ | Branch (402:4): [True: 1, False: 588] ------------------ 403| 1| goto done; 404| 1| case '\0': ------------------ | Branch (404:4): [True: 1, False: 588] ------------------ 405| 1| return HTTP_PARSE_INVALID; 406| 380| default: ------------------ | Branch (406:4): [True: 380, False: 209] ------------------ 407| 380| state = sw_value; 408| 380| break; 409| 589| } 410| 587| break; 411| | /* end of http_header line */ 412| 587| case sw_almost_done: ------------------ | Branch (412:3): [True: 197, False: 6.29M] ------------------ 413| 197| switch (ch) { 414| 1| case LF: ------------------ | | 34| 1|#define LF (unsigned char) '\n' ------------------ | Branch (414:4): [True: 1, False: 196] ------------------ 415| 1| goto done; 416| 194| case CR: ------------------ | | 35| 194|#define CR (unsigned char) '\r' ------------------ | Branch (416:4): [True: 194, False: 3] ------------------ 417| 194| break; 418| 2| default: ------------------ | Branch (418:4): [True: 2, False: 195] ------------------ 419| 2| return HTTP_PARSE_INVALID; 420| 197| } 421| 194| break; 422| | /* end of http_header */ 423| 194| case sw_header_almost_done: ------------------ | Branch (423:3): [True: 11, False: 6.29M] ------------------ 424| 11| if (ch == LF) ------------------ | | 34| 11|#define LF (unsigned char) '\n' ------------------ | Branch (424:8): [True: 1, False: 10] ------------------ 425| 1| goto header_done; 426| 10| else 427| 10| return HTTP_PARSE_INVALID; 428| 6.29M| } 429| 6.29M| } 430| | 431| 412|skipped_status: 432| 412| *bufp = p + 1; 433| 412| return HTTP_PARSE_CONTINUE; 434| | 435| 5|done: 436| 5| *bufp = p + 1; 437| 5| return HTTP_PARSE_OK; 438| | 439| 2|header_done: 440| 2| *bufp = p + 1; 441| 2| return HTTP_PARSE_DONE; 442| 437|} http_parser.c:http_parse_status_line: 59| 227|{ 60| 227| char ch; 61| 227| const char *p = *bufp; 62| 227| enum { 63| 227| sw_start = 0, 64| 227| sw_H, 65| 227| sw_HT, 66| 227| sw_HTT, 67| 227| sw_HTTP, 68| 227| sw_first_major_digit, 69| 227| sw_major_digit, 70| 227| sw_first_minor_digit, 71| 227| sw_minor_digit, 72| 227| sw_status, 73| 227| sw_space_after_status, 74| 227| sw_status_text, 75| 227| sw_almost_done 76| 227| } state; 77| | 78| 227| state = sw_start; 79| 227| int status_count = 0; 80| 3.57k| for (;p < end_buf; p++) { ------------------ | Branch (80:8): [True: 3.47k, False: 93] ------------------ 81| 3.47k| ch = *p; 82| 3.47k| switch (state) { ------------------ | Branch (82:11): [True: 0, False: 3.47k] ------------------ 83| | /* "HTTP/" */ 84| 227| case sw_start: ------------------ | Branch (84:3): [True: 227, False: 3.25k] ------------------ 85| 227| if (ch == 'H') ------------------ | Branch (85:8): [True: 227, False: 0] ------------------ 86| 227| state = sw_H; 87| 0| else 88| 0| return HTTP_PARSE_INVALID; 89| 227| break; 90| 227| case sw_H: ------------------ | Branch (90:3): [True: 227, False: 3.25k] ------------------ 91| 227| if (ch == 'T') ------------------ | Branch (91:8): [True: 227, False: 0] ------------------ 92| 227| state = sw_HT; 93| 0| else 94| 0| return HTTP_PARSE_INVALID; 95| 227| break; 96| 227| case sw_HT: ------------------ | Branch (96:3): [True: 227, False: 3.25k] ------------------ 97| 227| if (ch == 'T') ------------------ | Branch (97:8): [True: 227, False: 0] ------------------ 98| 227| state = sw_HTT; 99| 0| else 100| 0| return HTTP_PARSE_INVALID; 101| 227| break; 102| 227| case sw_HTT: ------------------ | Branch (102:3): [True: 227, False: 3.25k] ------------------ 103| 227| if (ch == 'P') ------------------ | Branch (103:8): [True: 227, False: 0] ------------------ 104| 227| state = sw_HTTP; 105| 0| else 106| 0| return HTTP_PARSE_INVALID; 107| 227| break; 108| 227| case sw_HTTP: ------------------ | Branch (108:3): [True: 227, False: 3.25k] ------------------ 109| 227| if (ch == '/') ------------------ | Branch (109:8): [True: 227, False: 0] ------------------ 110| 227| state = sw_first_major_digit; 111| 0| else 112| 0| return HTTP_PARSE_INVALID; 113| 227| break; 114| | /* The first digit of major HTTP version */ 115| 227| case sw_first_major_digit: ------------------ | Branch (115:3): [True: 226, False: 3.25k] ------------------ 116| 226| if (ch < '1' || ch > '9') { ------------------ | Branch (116:8): [True: 13, False: 213] | Branch (116:20): [True: 6, False: 207] ------------------ 117| 19| return HTTP_PARSE_INVALID; 118| 19| } 119| 207| parser->http_major = ch - '0'; 120| 207| state = sw_major_digit; 121| 207| break; 122| | /* The major HTTP version or dot */ 123| 219| case sw_major_digit: ------------------ | Branch (123:3): [True: 219, False: 3.26k] ------------------ 124| 219| if (ch == '.') { ------------------ | Branch (124:8): [True: 83, False: 136] ------------------ 125| 83| state = sw_first_minor_digit; 126| 83| break; 127| 83| } 128| 136| if (ch == ' ') { ------------------ | Branch (128:8): [True: 65, False: 71] ------------------ 129| 65| parser->http_minor = 0; 130| 65| state = sw_status; 131| 65| break; 132| 65| } 133| 71| if (ch < '0' || ch > '9') { ------------------ | Branch (133:8): [True: 24, False: 47] | Branch (133:20): [True: 10, False: 37] ------------------ 134| 34| return HTTP_PARSE_INVALID; 135| 34| } 136| 37| if (parser->http_major > 99) { ------------------ | Branch (136:8): [True: 3, False: 34] ------------------ 137| 3| return HTTP_PARSE_INVALID; 138| 3| } 139| 34| parser->http_major = parser->http_major * 10 140| 34| + (ch - '0'); 141| 34| break; 142| | /* The first digit of minor HTTP version */ 143| 82| case sw_first_minor_digit: ------------------ | Branch (143:3): [True: 82, False: 3.39k] ------------------ 144| 82| if (ch < '0' || ch > '9') { ------------------ | Branch (144:8): [True: 15, False: 67] | Branch (144:20): [True: 5, False: 62] ------------------ 145| 20| return HTTP_PARSE_INVALID; 146| 20| } 147| 62| parser->http_minor = ch - '0'; 148| 62| state = sw_minor_digit; 149| 62| break; 150| | /* 151| | * The minor HTTP version or 152| | * the end of the request line 153| | */ 154| 271| case sw_minor_digit: ------------------ | Branch (154:3): [True: 271, False: 3.20k] ------------------ 155| 271| if (ch == ' ') { ------------------ | Branch (155:8): [True: 5, False: 266] ------------------ 156| 5| state = sw_status; 157| 5| break; 158| 5| } 159| 266| if (ch < '0' || ch > '9') { ------------------ | Branch (159:8): [True: 19, False: 247] | Branch (159:20): [True: 5, False: 242] ------------------ 160| 24| return HTTP_PARSE_INVALID; 161| 24| } 162| 242| if (parser->http_minor > 99) { ------------------ | Branch (162:8): [True: 3, False: 239] ------------------ 163| 3| return HTTP_PARSE_INVALID; 164| 3| } 165| 239| parser->http_minor = parser->http_minor * 10 166| 239| + (ch - '0'); 167| 239| break; 168| | /* HTTP status code */ 169| 431| case sw_status: ------------------ | Branch (169:3): [True: 431, False: 3.04k] ------------------ 170| 431| if (ch == ' ') { ------------------ | Branch (170:8): [True: 321, False: 110] ------------------ 171| 321| break; 172| 321| } 173| 110| if (ch < '0' || ch > '9') { ------------------ | Branch (173:8): [True: 21, False: 89] | Branch (173:20): [True: 5, False: 84] ------------------ 174| 26| return HTTP_PARSE_INVALID; 175| 26| } 176| 84| if (++status_count == 3) { ------------------ | Branch (176:8): [True: 25, False: 59] ------------------ 177| 25| state = sw_space_after_status; 178| 25| } 179| 84| break; 180| | /* Space or end of line */ 181| 24| case sw_space_after_status: ------------------ | Branch (181:3): [True: 24, False: 3.45k] ------------------ 182| 24| switch (ch) { 183| 12| case ' ': ------------------ | Branch (183:4): [True: 12, False: 12] ------------------ 184| 12| state = sw_status_text; 185| 12| break; 186| 7| case '.': ------------------ | Branch (186:4): [True: 7, False: 17] ------------------ 187| | /* IIS may send 403.1, 403.2, etc */ 188| 7| state = sw_status_text; 189| 7| break; 190| 3| case CR: ------------------ | | 35| 3|#define CR (unsigned char) '\r' ------------------ | Branch (190:4): [True: 3, False: 21] ------------------ 191| 3| state = sw_almost_done; 192| 3| break; 193| 1| case LF: ------------------ | | 34| 1|#define LF (unsigned char) '\n' ------------------ | Branch (193:4): [True: 1, False: 23] ------------------ 194| 1| goto done; 195| 1| default: ------------------ | Branch (195:4): [True: 1, False: 23] ------------------ 196| 1| return HTTP_PARSE_INVALID; 197| 24| } 198| 22| break; 199| | /* Any text until end of line */ 200| 1.08k| case sw_status_text: ------------------ | Branch (200:3): [True: 1.08k, False: 2.39k] ------------------ 201| 1.08k| switch (ch) { ------------------ | Branch (201:12): [True: 1.08k, False: 3] ------------------ 202| 2| case CR: ------------------ | | 35| 2|#define CR (unsigned char) '\r' ------------------ | Branch (202:4): [True: 2, False: 1.08k] ------------------ 203| 2| state = sw_almost_done; 204| 2| break; 205| 1| case LF: ------------------ | | 34| 1|#define LF (unsigned char) '\n' ------------------ | Branch (205:4): [True: 1, False: 1.08k] ------------------ 206| 1| goto done; 207| 1.08k| } 208| 1.08k| break; 209| | 210| | /* End of status line */ 211| 1.08k| case sw_almost_done: ------------------ | Branch (211:3): [True: 2, False: 3.47k] ------------------ 212| 2| switch (ch) { 213| 1| case LF: ------------------ | | 34| 1|#define LF (unsigned char) '\n' ------------------ | Branch (213:4): [True: 1, False: 1] ------------------ 214| 1| goto done; 215| 1| default: ------------------ | Branch (215:4): [True: 1, False: 1] ------------------ 216| 1| return HTTP_PARSE_INVALID; 217| 2| } 218| 3.47k| } 219| 3.47k| } 220| 96|done: 221| 96| *bufp = p + 1; 222| 96| return HTTP_PARSE_OK; 223| 227|} LLVMFuzzerTestOneInput: 7| 437|{ 8| 437| struct http_parser parser; 9| 437| const char *buf = (char *)data; 10| 437| http_parser_create(&parser); 11| 437| parser.hdr_name = (char *)calloc(size, sizeof(char)); 12| 437| if (parser.hdr_name == NULL) ------------------ | Branch (12:6): [True: 0, False: 437] ------------------ 13| 0| return 0; 14| 437| const char *end_buf = buf + size; 15| 437| http_parse_header_line(&parser, &buf, end_buf, size); 16| 437| free(parser.hdr_name); 17| | 18| 437| return 0; 19| 437|}