search

daurnimator / lua-http

HTTP Library for Lua. Supports HTTP(S) 1.0, 1.1 and 2.0; client and server.
https://daurnimator.github.io/lua-http/
MIT License
807 stars 82 forks source link

http/h1_stream: handle EOF when `body_read_type==length` #213

Closed daurnimator closed 1 year ago

daurnimator commented 1 year ago

If a client closes the connection before sending the expected number of bytes then return EPIPE. This fixes a potential infinite draining loop when trying to trying to :shutdown() a stream.

bigben93 commented 1 year ago

I tested it and it works.

jirutka commented 1 year ago

For the record, this fixes vulnerability CVE-2023-4540.