updated the chunked state-machine to deal with the trailing CRLF that comes

after the data part

2 files changed, 39 insertions, 5 deletions

diff --git a/lib/http_chunks.c b/lib/http_chunks.c
index c11003354..89c860918 100644
--- a/lib/http_chunks.c
+++ b/lib/http_chunks.c
@@ -181,17 +181,43 @@ CHUNKcode Curl_httpchunk_read(struct connectdata *conn,
       length -= piece;   /* decrease space left in this round */
 
       if(0 == ch->datasize)
-        /* end of data this round, go back to get a new size */
-        Curl_httpchunk_init(conn);
+        /* end of data this round, we now expect a trailing CRLF */
+        ch->state = CHUNK_POSTCR;
+      break;
+
+    case CHUNK_POSTCR:
+      if(*datap == '\r') {
+        ch->state = CHUNK_POSTLF;
+        datap++;
+        length--;
+      }
+      else
+        return CHUNKE_BAD_CHUNK;
+      break;
 
+    case CHUNK_POSTLF:
+      if(*datap == '\n') {
+        /*
+         * The last one before we go back to hex state and start all
+         * over.
+         */
+        Curl_httpchunk_init(conn);
+        datap++;
+        length--;
+      }
+      else
+        return CHUNKE_BAD_CHUNK;
       break;
+
     case CHUNK_STOP:
       /* If we arrive here, there is data left in the end of the buffer
          even if there's no more chunks to read */
       ch->dataleft = length;
       return CHUNKE_STOP; /* return stop */
+#if 0
     default:
       return CHUNKE_STATE_ERROR;
+#endif
     }
   }
   return CHUNKE_OK;
diff --git a/lib/http_chunks.h b/lib/http_chunks.h
index 2b7c61692..c3e54a30b 100644
--- a/lib/http_chunks.h
+++ b/lib/http_chunks.h
@@ -30,7 +30,7 @@
 #define MAXNUM_SIZE 16
 
 typedef enum {
-  CHUNK_LOST, /* never use */
+  CHUNK_FIRST, /* never use */
 
   /* In this we await and buffer all hexadecimal digits until we get one
      that isn't a hexadecimal digit. When done, we go POSTHEX */
@@ -45,10 +45,17 @@ typedef enum {
      If the size given was zero, we set state to STOP and return. */
   CHUNK_CR,
 
-  /* We eat the amount of data specified. When done, we move back to the
-     HEX state. */
+  /* We eat the amount of data specified. When done, we move on to the
+     POST_CR state. */
   CHUNK_DATA,
 
+  /* POSTCR should get a CR and nothing else, then move to POSTLF */
+  CHUNK_POSTCR,
+
+  /* POSTLF should get a LF and nothing else, then move back to HEX as
+     the CRLF combination marks the end of a chunk */
+  CHUNK_POSTLF,
+
   /* This is mainly used to really mark that we're out of the game.
      NOTE: that there's a 'dataleft' field in the struct that will tell how
      many bytes that were not passed to the client in the end of the last
@@ -63,6 +70,7 @@ typedef enum {
   CHUNKE_OK = 0,
   CHUNKE_TOO_LONG_HEX = 1,
   CHUNKE_ILLEGAL_HEX,
+  CHUNKE_BAD_CHUNK,
   CHUNKE_WRITE_ERROR,
   CHUNKE_STATE_ERROR,
   CHUNKE_LAST