From: Henrik Nordstrom <henrik@henriknordstrom.net>
Date: Sat, 27 Aug 2011 13:42:04 +0000 (-0600)
Subject: Correct parsing of large Gopher indexes
X-Git-Tag: SQUID_3_0_STABLE26~5
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=49b294a12ed515e80dcc435614be61047c53d8e3;p=thirdparty%2Fsquid.git

Correct parsing of large Gopher indexes
---

diff --git a/src/gopher.cc b/src/gopher.cc
index 41d99dd01c..11f5f7673f 100644
--- a/src/gopher.cc
+++ b/src/gopher.cc
@@ -367,7 +367,6 @@ gopherToHTML(GopherStateData * gopherState, char *inbuf, int len)
         return;
     }
 
-    inbuf[len] = '\0';
     String outbuf;
 
     if (!gopherState->HTML_header_added) {
@@ -383,75 +382,48 @@ gopherToHTML(GopherStateData * gopherState, char *inbuf, int len)
         gopherState->HTML_pre = 1;
     }
 
-    while ((pos != NULL) && (pos < inbuf + len)) {
-
+    while (pos < inbuf + len) {
+        int llen;
+        int left = len - (pos - inbuf);
+        lpos = (char *)memchr(pos, '\n', left);
+        if (lpos) {
+            lpos++;             /* Next line is after \n */
+            llen = lpos - pos;
+        } else {
+            llen = left;
+        }
+        if (gopherState->len + llen >= TEMP_BUF_SIZE) {
+            debugs(10, 1, "GopherHTML: Buffer overflow. Lost some data on URL: " << entry->url()  );
+            llen = TEMP_BUF_SIZE - gopherState->len - 1;
+        }
+        if (!lpos) {
+            /* there is no complete line in inbuf */
+            /* copy it to temp buffer */
+            /* note: llen is adjusted above */
+            xmemcpy(gopherState->buf + gopherState->len, pos, llen);
+            gopherState->len += llen;
+            break;
+        }
+        if (!lpos) {
+            /* there is no complete line in inbuf */
+            /* copy it to temp buffer */
+            /* note: llen is adjusted above */
+            xmemcpy(gopherState->buf + gopherState->len, pos, llen);
+            gopherState->len += llen;
+            break;
+        }
         if (gopherState->len != 0) {
             /* there is something left from last tx. */
-            xstrncpy(line, gopherState->buf, gopherState->len + 1);
-
-            if (gopherState->len + len > TEMP_BUF_SIZE) {
-                debugs(10, 1, "GopherHTML: Buffer overflow. Lost some data on URL: " << entry->url()  );
-                len = TEMP_BUF_SIZE - gopherState->len;
-            }
-
-            lpos = (char *) memccpy(line + gopherState->len, inbuf, '\n', len);
-
-            if (lpos)
-                *lpos = '\0';
-            else {
-                /* there is no complete line in inbuf */
-                /* copy it to temp buffer */
-
-                if (gopherState->len + len > TEMP_BUF_SIZE) {
-                    debugs(10, 1, "GopherHTML: Buffer overflow. Lost some data on URL: " << entry->url()  );
-                    len = TEMP_BUF_SIZE - gopherState->len;
-                }
-
-                xmemcpy(gopherState->buf + gopherState->len, inbuf, len);
-                gopherState->len += len;
-                return;
-            }
-
-            /* skip one line */
-            pos = (char *) memchr(pos, '\n', len);
-
-            if (pos)
-                pos++;
-
-            /* we're done with the remain from last tx. */
+            xmemcpy(line, gopherState->buf, gopherState->len);
+            xmemcpy(line + gopherState->len, pos, llen);
+            llen += gopherState->len;
             gopherState->len = 0;
-
-            *(gopherState->buf) = '\0';
         } else {
-
-            lpos = (char *) memccpy(line, pos, '\n', len - (pos - inbuf));
-
-            if (lpos)
-                *lpos = '\0';
-            else {
-                /* there is no complete line in inbuf */
-                /* copy it to temp buffer */
-
-                if ((len - (pos - inbuf)) > TEMP_BUF_SIZE) {
-                    debugs(10, 1, "GopherHTML: Buffer overflow. Lost some data on URL: " << entry->url()  );
-                    len = TEMP_BUF_SIZE;
-                }
-
-                if (len > (pos - inbuf)) {
-                    xmemcpy(gopherState->buf, pos, len - (pos - inbuf));
-                    gopherState->len = len - (pos - inbuf);
-                }
-
-                break;
-            }
-
-            /* skip one line */
-            pos = (char *) memchr(pos, '\n', len);
-
-            if (pos)
-                pos++;
-
+            xmemcpy(line, pos, llen);
         }
+        line[llen + 1] = '\0';
+        /* move input to next line */
+        pos = lpos;
 
         /* at this point. We should have one line in buffer to process */