Bad pointer arithmetic in header field parsing

[bnoordhuis]

http-parser/http_parser.c

Lines 1259 to 1266 in c5c4563

	case h_general: {
	size_t limit = data + len - p;
	limit = MIN(limit, max_header_size);
	while (p+1 < data + limit && TOKEN(p[1])) {
	p++;
	}
	break;
	}

What that code calls limit is actually the number of remaining characters.

p+1 < data+limit must be wrong because data+limit is not fixed, it gets smaller as the p on line 1260 gets bigger.

Say, len == 8 and p == data + 5, then data + len - p == 3. Ergo, p+1 < data+limit is always false in that case.

[indutny]

Let's do some math:

len = 16000
p - data = 100
max_header_size = 8000
limit = 7900

It seems that there would be some p for which the condition is going to be false?

[bnoordhuis]

IIUC your example, limit gets clamped to 8000 because MIN(16000 - 100, 8000).