Source code
Revision control
Copy as Markdown
Other Tools
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
/*
* test_httpdefaultclient.c
*
* Test HttpDefaultClient header parsing, in particular that a malformed
* HTTP response whose body is larger than its declared Content-Length is
*
*/
#include "testutil.h"
#include "testutil_nss.h"
#include "pkix_pl_common.h"
#include "pkix_pl_httpdefaultclient.h"
static void *plContext = NULL;
/*
* Drives pkix_pl_HttpDefaultClient_HdrCheckComplete over a single,
* fully-buffered HTTP response and checks the resulting connectStatus.
*
* "response"/"responseLen" describe the bytes the client has just received
* (header and body together, exactly as a single read would have delivered
* them). "expectedStatus" is the connectStatus the header parser should
* settle on.
*/
static void
testResponse(
char *subTestName,
const char *response,
PKIX_UInt32 responseLen,
HttpConnectStatus expectedStatus)
{
PKIX_PL_HttpDefaultClient *client = NULL;
PKIX_Boolean keepGoing = PKIX_FALSE;
char *rcvBuf = NULL;
PKIX_TEST_STD_VARS();
subTest(subTestName);
PKIX_TEST_EXPECT_NO_ERROR(pkix_pl_HttpDefaultClient_Create(
"localhost", 80, &client, plContext));
/*
* Hand the client a receive buffer holding the whole response. The
* buffer is sized exactly to the bytes received, so an over-copy past
* the declared Content-Length is caught by ASan as a heap overflow.
*/
PKIX_TEST_EXPECT_NO_ERROR(
PKIX_PL_Malloc(responseLen, (void **)&rcvBuf, plContext));
PORT_Memcpy(rcvBuf, response, responseLen);
client->rcvBuf = rcvBuf;
client->capacity = responseLen;
client->filledupBytes = 0;
client->connectStatus = HTTP_RECV_HDR;
/* Ownership of rcvBuf passes to the client; it is freed on Destroy. */
rcvBuf = NULL;
PKIX_TEST_EXPECT_NO_ERROR(pkix_pl_HttpDefaultClient_HdrCheckComplete(
client, responseLen, &keepGoing, plContext));
if (client->connectStatus != expectedStatus) {
pkixTestErrorMsg =
"HdrCheckComplete produced an unexpected connectStatus.";
goto cleanup;
}
cleanup:
PKIX_TEST_DECREF_AC(client);
PKIX_TEST_RETURN();
}
int
test_httpdefaultclient(int argc, char *argv[])
{
/*
* A 1-byte body that occupies its full declared Content-Length: the
* parser should report a complete message.
*/
const char *exact =
"HTTP/1.0 200 OK\r\n"
"Content-Type: application/ocsp-response\r\n"
"Content-Length: 1\r\n"
"\r\n"
"A";
/*
* Content-Length declares more than is present: the parser should ask
* for more body data.
*/
const char *shortBody =
"HTTP/1.0 200 OK\r\n"
"Content-Type: application/ocsp-response\r\n"
"Content-Length: 16\r\n"
"\r\n"
"A";
/*
* but 64 body bytes are delivered in the same buffer. The parser must
* reject the response rather than copy 64 bytes into a 1-byte buffer.
*/
const char *overflow =
"HTTP/1.0 200 OK\r\n"
"Content-Type: application/ocsp-response\r\n"
"Content-Length: 1\r\n"
"\r\n"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
PKIX_UInt32 actualMinorVersion = 0;
PKIX_TEST_STD_VARS();
startTests("HttpDefaultClient");
PKIX_TEST_EXPECT_NO_ERROR(PKIX_Initialize(PKIX_TRUE, /* nssInitNeeded */
PKIX_MAJOR_VERSION,
PKIX_MINOR_VERSION,
PKIX_MINOR_VERSION,
&actualMinorVersion,
&plContext));
testResponse("Body matches Content-Length (complete)",
exact, PL_strlen(exact), HTTP_COMPLETE);
testResponse("Body shorter than Content-Length (need more)",
shortBody, PL_strlen(shortBody), HTTP_RECV_BODY);
overflow, PL_strlen(overflow), HTTP_ERROR);
cleanup:
PKIX_Shutdown(plContext);
PKIX_TEST_RETURN();
endTests("HttpDefaultClient");
return (0);
}