http: remove unused and broken 'content-len' logic

The HTTP tracking code would parse the content lenght and store it
in the TX user data. It didn't take the possibility or errors into
account though, leading to a possible negative int being cases to
unsigned int. Luckily, the result was unused.

This patch simply removes the offending code.

Reported-by: The Yahoo pentest team

diff --git a/src/app-layer-htp.c b/src/app-layer-htp.c
index 7514b374e3cc444846469175c4bae722d816e333..b0038e20d1097541864b9ef898d13b6e31b5cd2b 100644 (file)
--- a/src/app-layer-htp.c
+++ b/src/app-layer-htp.c
@@ -1017,10 +1017,6 @@ static int HTTPParseContentTypeHeader(uint8_t *name, size_t name_len,
  */
 static int HtpRequestBodySetupMultipart(htp_tx_data_t *d, HtpTxUserData *htud)
 {
-    htp_header_t *cl = htp_table_get_c(d->tx->request_headers, "content-length");
-    if (cl != NULL)
-        htud->request_body.content_len = SC_htp_parse_content_length(cl->value);
-
     htp_header_t *h = (htp_header_t *)htp_table_get_c(d->tx->request_headers,
             "Content-Type");
     if (h != NULL && bstr_len(h->value) > 0) {
@@ -1881,11 +1877,6 @@ int HTPCallbackResponseBodyData(htp_tx_data_t *d)
     if (!tx_ud->request_body_init) {
         tx_ud->request_body_init = 1;
         tx_ud->operation = HTP_BODY_RESPONSE;
-
-        htp_header_t *cl = htp_table_get_c(d->tx->response_headers, "content-length");
-        if (cl != NULL)
-            tx_ud->response_body.content_len = SC_htp_parse_content_length(cl->value);
-
     }
 
     SCLogDebug("tx_ud->response_body.content_len_so_far %"PRIu64, tx_ud->response_body.content_len_so_far);

diff --git a/src/app-layer-htp.h b/src/app-layer-htp.h
index d331dd0e9d84d75b170b7a52fc4ea1c3e042230b..7fca45e03cbccde094e02ccbef95fca0af3d236b 100644 (file)
--- a/src/app-layer-htp.h
+++ b/src/app-layer-htp.h
@@ -170,8 +170,6 @@ typedef struct HtpBody_ {
     HtpBodyChunk *first; /**< Pointer to the first chunk */
     HtpBodyChunk *last;  /**< Pointer to the last chunk */
 
-    /* Holds the length of the htp request body */
-    uint64_t content_len;
     /* Holds the length of the htp request body seen so far */
     uint64_t content_len_so_far;
     /* parser tracker */