Fix parser off by one accessing buffer bug:

This fixed a bug where in some cases the parser could dereference
past the end of the caller provided buffer. The unit test is
improved to allocate memory in separate pieces for the split-buffer
matrix test, to give address-sanitizer more to work with.
This commit is contained in:
Vinnie Falco
2016-05-15 16:21:36 -04:00
parent 18c82465b2
commit a570b74038
2 changed files with 16 additions and 4 deletions

View File

@@ -463,8 +463,9 @@ write(boost::asio::const_buffer const& buffer, error_code& ec)
case s_header_field:
{
for(; p != end; ch = *++p)
for(; p != end; ++p)
{
ch = *p;
auto c = to_field_char(ch);
if(! c)
break;
@@ -660,8 +661,9 @@ write(boost::asio::const_buffer const& buffer, error_code& ec)
case s_header_value_text:
{
for(; p != end; ch = *++p)
for(; p != end; ++p)
{
ch = *p;
if(ch == '\r')
{
if(cb(nullptr))