the function htparser_get_strerror may have a out-of-bounds read

[linimbus]

Details

Steps or code to reproduce the problem.

1. The Array of string pointers errstr_map only have 13 item

2. But. The Enum type htpparse_error had defined 14 item

3. This code if (e > (htparse_error_generic + 1)) may cause value e large than that array errstr_map size.

Example code (if applicable)

const char * htparser_get_strerror(htparser * p)
{
    htpparse_error e = htparser_get_error(p);

    if (e > (htparse_error_generic + 1))
    {
        return "htparse_no_such_error";
    }

    return errstr_map[e];
}

Version

latest

[NathanFrench]

I would love to know how someone could have triggered this, since that structure is never made public, thus it was never abused; but a bug is a bug, and I fixed it up here 75574ba

Will merge in a bit.

[NathanFrench]

All good - thanks again! You're my human static analyzer!

[linimbus]

I am happy to contribute to this project!