Skip to content
Commit 989fdadf authored by Matt Rodgers's avatar Matt Rodgers Committed by Anas Nashif
Browse files

net: lib: http_server: prevent falsely matching HTTP headers



Using strncasecmp to match HTTP headers can give unexpected results when
the strings to be compared match up until the end of one string, but the
other string contains additional characters. This can result in falsely
matching a HTTP header value, for example:

strncasecmp("Upgrade-Something", "Upgrade", sizeof("Upgrade") - 1) --> 0

In this case we know that both strings are NULL terminated since one is
a string literal and we have just length-checked and explicitly NULL
terminated the other. So we can just use strcasecmp without a max
length.

Signed-off-by: default avatarMatt Rodgers <mrodgers@witekio.com>
parent db890a20
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment