Skip to content
This repository has been archived by the owner on Apr 22, 2023. It is now read-only.

Wrong Buffer.slice call in http.js #565

Closed
nicokaiser opened this issue Jan 17, 2011 · 1 comment
Closed

Wrong Buffer.slice call in http.js #565

nicokaiser opened this issue Jan 17, 2011 · 1 comment

Comments

@nicokaiser
Copy link

In some rare situations, it can occur that the "d.slice" call in "connectionListener" fails because (start + byteParsed + 1) > end.

This patch solves this by just closing the socket instead of crashing Node:

--- http.js.orig    2011-01-17 14:45:31.000000000 +0100
+++ http.js 2011-01-17 14:46:01.000000000 +0100
@@ -797,6 +797,11 @@

       // This is start + byteParsed + 1 due to the error of getting \n
       // in the upgradeHead from the closing lines of the headers
+      if (start + bytesParsed + 1 > end) {
+          console.log('Node Error: Trying to d.slice(' + (start + bytesParsed + 1) + ', ' + end + ')');
+          socket.destroy();
+          return;
+      }
       var upgradeHead = d.slice(start + bytesParsed + 1, end);

       if (self.listeners('upgrade').length) {
@nicokaiser
Copy link
Author

Before this patch, Node just dies with this error:

buffer.js:329
  if (start > end) throw new Error('oob');
                         ^ 

Error: oob
at Buffer.slice (buffer.js:329:26)
at Socket. (http.js:800:27)
at Socket._onReadable (net.js:623:27)
at IOWatcher.onReadable as callback

This issue was closed.
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant