Fix for out of bound read in std::strtol while parsing HTTP requests

src/common/http.cc

@@ -29,6 +29,7 @@
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
+#include <charconv>
 
 namespace Pistache::Http
 {
@@ -287,9 +288,18 @@ namespace Pistache::Http
             if (!match_until(' ', cursor))
                 return State::Again;
 
-            char* end;
-            auto code = strtol(codeToken.rawText(), &end, 10);
-            if (*end != ' ')
+            const char* beg = codeToken.rawText();
+            const char* beg_trim = beg;
+            while (*beg_trim == '+' || *beg_trim == ' ')
+            {
+                if (*(beg_trim + 1))
+                    ++beg_trim;                    
+            }
+            std::string_view view(beg_trim, codeToken.size());
+            const char* end = view.data() + view.size();
+            long code = 0;
+            auto res = std::from_chars(beg_trim, end, code);
+            if (*res.ptr != ' ')
                 raise("Failed to parse return code");
             response->code_ = static_cast<Http::Code>(code);
 
@@ -455,10 +465,18 @@ namespace Pistache::Http
                     if (!cursor.advance(1))
                         return Incomplete;
 
-                char* end;
-                const char* raw = chunkSize.rawText();
-                auto sz         = std::strtol(raw, &end, 16);
-                if (*end != '\r')
+                const char* beg = chunkSize.rawText();
+                const char* beg_trim = beg;
+                while (*beg_trim == '+' || *beg_trim == ' ')
+                {
+                    if (*(beg_trim + 1))
+                        ++beg_trim; 
+                }
+                std::string_view view = beg_trim;
+                const char* end = view.data() + view.size();
+                long sz = 0;
+                auto res = std::from_chars(beg_trim, end, sz, 16);
+                if (*res.ptr != '\r')
                     throw std::runtime_error("Invalid chunk size");
 
                 // CRLF

src/common/http_header.cc

@@ -26,6 +26,7 @@
 #include <string>
 #include <string_view>
 #include <sys/socket.h>
+#include <charconv>
 
 namespace Pistache::Http::Header
 {
@@ -221,13 +222,21 @@ namespace Pistache::Http::Header
                                 "Invalid caching directive, missing delta-seconds");
                         }
 
-                        char* end;
                         const char* beg = cursor.offset();
+                        const char* beg_trim = beg;
                         // @Security: if str is not \0 terminated, there might be a situation
                         // where strtol can overflow. Double-check that it's harmless and fix
                         // if not
-                        auto secs = strtol(beg, &end, 10);
-                        cursor.advance(end - beg);
+                        while (*beg_trim == '+' || *beg_trim == ' ')
+                        {
+                            if (*(beg_trim + 1))
+                                ++beg_trim; 
+                        }
+                        std::string_view view = beg_trim;
+                        const char* end = view.data() + view.size();
+                        long secs = 0;
+                        auto res = std::from_chars(beg_trim, end, secs);
+                        cursor.advance(res.ptr - beg);
                         if (!cursor.eof() && cursor.current() != ',')
                         {
                             throw std::runtime_error(

src/common/net.cc

@@ -27,6 +27,7 @@
 #include <netdb.h>
 #include <sys/socket.h>
 #include <sys/types.h>
+#include <charconv>
 
 namespace Pistache
 {
@@ -38,9 +39,18 @@ namespace Pistache
     {
         if (data.empty())
             throw std::invalid_argument("Invalid port: empty port");
-        char* end     = nullptr;
-        long port_num = strtol(data.c_str(), &end, 10);
-        if (*end != 0 || port_num < Port::min() || port_num > Port::max())
+        const char* beg = data.c_str();
+        const char* beg_trim = beg;
+        while (*beg_trim == '+' || *beg_trim == ' ')
+        {
+            if (*(beg_trim + 1))
+                ++beg_trim; 
+        }
+        std::string_view view = beg_trim;
+        const char* end = view.data() + view.size();
+        long port_num = 0;
+        auto res = std::from_chars(beg_trim, end, port_num);
+        if (*res.ptr != 0 || port_num < Port::min() || port_num > Port::max())
             throw std::invalid_argument("Invalid port: " + data);
         port = static_cast<uint16_t>(port_num);
     }
@@ -312,9 +322,18 @@ namespace Pistache
                 throw std::invalid_argument("Invalid port");
 
             // Check if port_ is a valid number
-            char* tmp;
-            std::strtol(port_.c_str(), &tmp, 10);
-            hasNumericPort_ = *tmp == '\0';
+            const char* beg = port_.c_str();
+            const char* beg_trim = beg;
+            while (*beg_trim == '+' || *beg_trim == ' ')
+            {
+                if (*(beg_trim + 1))
+                    ++beg_trim; 
+            }
+            std::string_view view = beg_trim;
+            const char* end = view.data() + view.size();
+            long port_num = 0;
+            auto res = std::from_chars(beg_trim, end, port_num);
+            hasNumericPort_ = !(res.ec != std::errc{} || res.ptr != end);
         }
     }
 
@@ -446,7 +465,18 @@ namespace Pistache
         port_ = Port(ip_.getPort());
 
         // Check that the port has not overflowed while calling getaddrinfo()
-        if (parser.hasNumericPort() && port_ != std::strtol(addrinfo_port, nullptr, 10))
+        const char* beg = addrinfo_port;
+        const char* beg_trim = beg;
+        while (*beg_trim == '+' || *beg_trim == ' ')
+        {
+            if (*(beg_trim + 1))
+                ++beg_trim; 
+        }
+        std::string_view view = beg_trim;
+        const char* end = view.data() + view.size();
+        long addrinfo_port_num = 0;
+        std::from_chars(beg_trim, end, addrinfo_port_num);
+        if (parser.hasNumericPort() && port_ != addrinfo_port_num)
         {
             throw std::invalid_argument("Invalid numeric port");
         }

version.txt

@@ -1 +1 @@
-0.2.9.20240428
+0.2.10.20240428