jamesroberts / fastwsgi

An ultra fast WSGI server for Python 3
Other
437 stars 15 forks source link

Crashes on malformed URLs #1

Closed JohnEmhoff closed 2 years ago

JohnEmhoff commented 2 years ago

This segfaults with faulty URLs, at a glance due to the unsafe use of strotk:

$ python example.py
==== FastWSGI ==== 
Host: 0.0.0.0
Port: 5000
==================

Server listening at http://0.0.0.0:5000
Parse error: HPE_INVALID_URL Unexpected start char in url
free(): double free detected in tcache 2
[1]    70550 IOT instruction (core dumped)  python example.py
telnet localhost 5000
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
GET ?????

XKT�k�VLk
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
Content-Length: 13

Hello, World!Connection closed by foreign host.
jamesroberts commented 2 years ago

Thanks so much for reporting this! I will definitely take a look into this

jamesroberts commented 2 years ago

This should be addressed by a9db3be5aace75acf9cc1b29bfa4515041af09a1 and b0b13426d3b78cf34f8fa0650a9e4605b7e32230.

This change has been released in the 0.0.5 release on Pypi

Thanks for submitting the issue!