lighttpd
/
lighttpd1.4
2
0
Fork 0
Code Issues Releases Wiki Activity

[mod_magnet] rename var for clarity (fixes #1483) 

"length" argument is more accurately described as 0-index end of range

x-ref:
  "magnet offset > length bug"
  https://redmine.lighttpd.net/issues/1483
This commit is contained in:
Glenn Strauss 2016-04-13 00:07:26 -04:00
parent 4b412797b8
commit 659ce5e78e
2 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
NEWS
View File

@ -65,6 +65,7 @@ NEWS
* [mod_fastcgi,mod_scgi] check for spawning on same unix socket (fixes #319)
* [mod_cgi] always set QUERY_STRING (fixes #1339)
* [mod_auth] send charset="UTF-8" in WWW-Authenticate (fixes #1468)
* [mod_magnet] rename var for clarity (fixes #1483)
- 1.4.39 - 2016-01-02
* [core] fix memset_s call (fixes #2698)

10
src/mod_magnet.c
View File

@ -733,8 +733,8 @@ static int magnet_attach_content(server *srv, connection *con, lua_State *L, int
chunkqueue_append_mem(con->write_queue, data.ptr, data.len);
} else if (lua_istable(L, -1)) {
lua_getfield(L, -1, "filename");
lua_getfield(L, -2, "length");
lua_getfield(L, -3, "offset");
lua_getfield(L, -2, "length"); /* (0-based) end of range (not actually "length") */
lua_getfield(L, -3, "offset"); /* (0-based) start of range */
if (lua_isstring(L, -3)) { /* filename has to be a string */
buffer *fn;
@ -747,19 +747,19 @@ static int magnet_attach_content(server *srv, connection *con, lua_State *L, int
if (HANDLER_GO_ON == res) {
off_t off = (off_t) luaL_optinteger(L, -1, 0);
off_t len = (off_t) luaL_optinteger(L, -2, (lua_Integer) sce->st.st_size);
off_t end = (off_t) luaL_optinteger(L, -2, (lua_Integer) sce->st.st_size);
if (off < 0) {
buffer_free(fn);
return luaL_error(L, "offset for '%s' is negative", lua_tostring(L, -3));
}
if (len < off) {
if (end < off) {
buffer_free(fn);
return luaL_error(L, "offset > length for '%s'", lua_tostring(L, -3));
}
chunkqueue_append_file(con->write_queue, fn, off, len - off);
chunkqueue_append_file(con->write_queue, fn, off, end - off);
}
buffer_free(fn);