Arne Welzel 540fe7aff7 http: Heuristic around rejecting malformed HTTP/0.9 traffic ...

oss-fuzz generated "HTTP traffic" containing 250k+ sequences of "T<space>\r\r"
which Zeek then logged as individual HTTP requests. Add a heuristic to bail
on such request lines. It's a bit specific to the test case, but should work.

There are more issues around handling HTTP/0.9, e.g. triggering
"not a http reply line" when HTTP/0.9 never had such a thing, but
I don't think that's worth fixing up.

Fixes #119

2022-11-18 18:19:58 +01:00

829 B

Raw History

View raw