mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
540fe7aff7
oss-fuzz generated "HTTP traffic" containing 250k+ sequences of "T<space>\r\r" which Zeek then logged as individual HTTP requests. Add a heuristic to bail on such request lines. It's a bit specific to the test case, but should work. There are more issues around handling HTTP/0.9, e.g. triggering "not a http reply line" when HTTP/0.9 never had such a thing, but I don't think that's worth fixing up. Fixes #119
7 lines
257 B
Text
7 lines
257 B
Text
# @TEST-DOC: curl --http0.9 to accept the headerless response.
|
|
# @TEST-EXEC: zeek -b -Cr $TRACES/http/curl_http_09.pcap %INPUT
|
|
# @TEST-EXEC: btest-diff http.log
|
|
# @TEST-EXEC: test ! -f weird.log
|
|
|
|
@load base/frameworks/notice/weird
|
|
@load base/protocols/http
|