diff --git a/src/analyzer/protocol/http/HTTP.cc b/src/analyzer/protocol/http/HTTP.cc index 318a3f9774..f9f32ba347 100644 --- a/src/analyzer/protocol/http/HTTP.cc +++ b/src/analyzer/protocol/http/HTTP.cc @@ -425,8 +425,14 @@ void HTTP_Entity::SubmitHeader(analyzer::mime::MIME_Header* h) first_byte_pos.c_str(), last_byte_pos.c_str(), instance_length_str.c_str()); int64_t f, l; - util::atoi_n(first_byte_pos.size(), first_byte_pos.c_str(), nullptr, 10, f); - util::atoi_n(last_byte_pos.size(), last_byte_pos.c_str(), nullptr, 10, l); + int fr = util::atoi_n(first_byte_pos.size(), first_byte_pos.c_str(), nullptr, 10, f); + int lr = util::atoi_n(last_byte_pos.size(), last_byte_pos.c_str(), nullptr, 10, l); + if ( fr != 1 || lr != 1 ) + { + http_message->Weird("HTTP_content_range_cannot_parse"); + return; + } + int64_t len = l - f + 1; if ( DEBUG_http ) diff --git a/testing/btest/Baseline/scripts.base.protocols.http.bad-content-range/http.log b/testing/btest/Baseline/scripts.base.protocols.http.bad-content-range/http.log new file mode 100644 index 0000000000..e5a448b593 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.http.bad-content-range/http.log @@ -0,0 +1,11 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path http +#open XXXX-XX-XX-XX-XX-XX +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent origin request_body_len response_body_len status_code status_msg info_code info_msg tags username password proxied orig_fuids orig_filenames orig_mime_types resp_fuids resp_filenames resp_mime_types +#types time string addr port addr port count string string string string string string string count count count string count string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string] vector[string] vector[string] +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 42226 127.0.0.1 8080 1 GET localhost:8080 / - 1.1 curl/7.74.0 - 0 16 206 Partial Content - - (empty) - - - - - - FMJdmJBUqlAAHLXAd - - +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.http.bad-content-range/weird.log b/testing/btest/Baseline/scripts.base.protocols.http.bad-content-range/weird.log new file mode 100644 index 0000000000..0c73c5334e --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.http.bad-content-range/weird.log @@ -0,0 +1,11 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path weird +#open XXXX-XX-XX-XX-XX-XX +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source +#types time string addr port addr port string string bool string string +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 42226 127.0.0.1 8080 HTTP_content_range_cannot_parse - F zeek HTTP +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Traces/http/http-bad-content-range-01.pcap b/testing/btest/Traces/http/http-bad-content-range-01.pcap new file mode 100644 index 0000000000..9ca75e011c Binary files /dev/null and b/testing/btest/Traces/http/http-bad-content-range-01.pcap differ diff --git a/testing/btest/scripts/base/protocols/http/bad-content-range.zeek b/testing/btest/scripts/base/protocols/http/bad-content-range.zeek new file mode 100644 index 0000000000..aed3ff959d --- /dev/null +++ b/testing/btest/scripts/base/protocols/http/bad-content-range.zeek @@ -0,0 +1,3 @@ +# @TEST-EXEC: zeek -b base/protocols/http -r $TRACES/http/http-bad-content-range-01.pcap +# @TEST-EXEC: btest-diff http.log +# @TEST-EXEC: btest-diff weird.log