diff options
| author | Didier Spezia <didier.06@gmail.com> | 2015-09-26 17:21:35 +0000 |
|---|---|---|
| committer | Brad Fitzpatrick <bradfitz@golang.org> | 2015-09-27 06:57:03 +0000 |
| commit | b7fa4f27ba0c127512f2c4808c628efe842ff660 (patch) | |
| tree | 7f4d6e364804b2b7fa34002ced3d23705a9c9ba8 /src/encoding/json/encode.go | |
| parent | c4689579c0bcd0ea028e3847e7d407141faa26e2 (diff) | |
| download | go-b7fa4f27ba0c127512f2c4808c628efe842ff660.tar.xz | |
net/http/fcgi: fix panic with malformed params record
As stated in FastCGI specifications:
FastCGI transmits a name-value pair as the length of the name,
followed by the length of the value, followed by the name,
followed by the value.
The current implementation trusts the name and value length
provided in the record, leading to a panic if the record
is malformed.
Added an explicit check on the lengths.
Test case and fix suggested by diogin@gmail.com (Jingcheng Zhang)
Fixes #11824
Change-Id: I883a1982ea46465e1fb02e0e02b6a4df9e529ae4
Reviewed-on: https://go-review.googlesource.com/15015
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Diffstat (limited to 'src/encoding/json/encode.go')
0 files changed, 0 insertions, 0 deletions