glyph11: a Content-Length the checks accept frames a length - OWS before a list's comma no longer drops it, and 2^63 and up is held at Long.MAX_VALUE - never no body, which read the body as the next request

Author: MDA2AV

glyph11/src/main/kotlin/ExactParser.kt

@@ -277,8 +277,8 @@ internal object ExactParser {
 
 /**
  * BodyFramingDetector.detectBodyFraming over a parsed [RequestHead]: chunked if a Transfer-Encoding is "chunked",
- * else the last Content-Length's leading digits when they are positive, else no body. It keeps the detector's
- * reading of the value exactly: the digits before the first comma, so `5 ,5` (a space before the comma) is no body.
+ * else the last Content-Length's leading digits when they are positive, else no body: the digits before the first
+ * comma and the OWS before it, so `5 ,5` is 5.
  */
 internal object HeadFraming {
     private val TE = "transfer-encoding".toByteArray(Charsets.US_ASCII)
@@ -309,7 +309,9 @@ internal object HeadFraming {
         }
         if (clStart >= 0 && clEnd > clStart) {
             val comma = Ascii.indexOf(a, ','.code, clStart, clEnd)
-            val value = leadingDigits(a, clStart, if (comma >= 0) comma else clEnd)
+            var to = if (comma >= 0) comma else clEnd
+            while (to > clStart && isOws(a[to - 1].toInt())) to--
+            val value = leadingDigits(a, clStart, to)
             if (value > 0) {
                 head.bodyFraming = RequestHead.BODY_LENGTH
                 head.contentLength = value
@@ -319,7 +321,10 @@ internal object HeadFraming {
         head.bodyFraming = RequestHead.BODY_NONE
     }
 
-    /** `[from, to)` as a decimal number, -1 if it is empty, holds a non-digit, or overflows a Long. */
+    /**
+     * `[from, to)` as a decimal number, -1 if it is empty or holds a non-digit, Long.MAX_VALUE from 2^63 up: longer
+     * than any body may be, so refused rather than read as no body.
+     */
     @JvmStatic
     fun leadingDigits(a: ByteArray, from: Int, to: Int): Long {
         if (to == from) return -1
@@ -328,7 +333,10 @@ internal object HeadFraming {
             val d = a[j] - '0'.code.toByte()
             if (d < 0 || d > 9) return -1
             result = result * 10 + d
-            if (result < 0) return -1
+            if (result < 0) {
+                for (k in j + 1 until to) if (a[k] < '0'.code.toByte() || a[k] > '9'.code.toByte()) return -1
+                return Long.MAX_VALUE
+            }
         }
         return result
     }

glyph11/src/main/kotlin/Glyph11.kt

@@ -380,23 +380,23 @@ internal object FastParser {
 
     /**
      * A Content-Length value `[v, e)`, its leading OWS skipped: [CL_INVALID] unless UltraHardenedParser accepts it,
-     * 1*DIGIT without a leading zero and at most 2^64 - 1, its comma-separated copies all the same digits; else what
-     * BodyFramingDetector frames it as, those digits as a Long, -1 (no body) when they overflow one or OWS stands
-     * between them and the first comma.
+     * 1*DIGIT without a leading zero and at most 2^64 - 1, its comma-separated copies all the same digits; else those
+     * digits as a Long, held at Long.MAX_VALUE from 2^63 up.
      */
     @Suppress("NOTHING_TO_INLINE")
     private inline fun contentLengthOf(a: ByteArray, v: Int, e: Int): Long {
         if (v >= e || !isDigit(a[v])) return CL_INVALID
         var p = v + 1
-        // the digits' value as BodyFramingDetector reads them (HeadFraming.leadingDigits): -1 once a step overflows
+        // a length past 2^63 - 1 is longer than any body may be: held at Long.MAX_VALUE, so it is refused as too large
+        // rather than framed as no body, which would read the body as the next request
         var framing = (a[v] - '0'.code.toByte()).toLong()
         if (a[v] == '0'.code.toByte()) {
             if (p < e && isDigit(a[p])) return CL_INVALID
         } else {
             while (p < e && isDigit(a[p])) {
-                if (framing >= 0) {
+                if (framing != Long.MAX_VALUE) {
                     framing = framing * 10 + (a[p] - '0'.code.toByte())
-                    if (framing < 0) framing = -1
+                    if (framing < 0) framing = Long.MAX_VALUE
                 }
                 p++
             }
@@ -406,7 +406,6 @@ internal object FastParser {
         var q = p
         while (q < e && isOws(a[q])) q++
         if (q < e) {
-            if (q > p) framing = -1
             while (true) {
                 if (a[q] != ','.code.toByte()) return CL_INVALID
                 q++

glyph11/src/main/kotlin/validation/BodyFramingDetector.kt

@@ -135,10 +135,12 @@ public object BodyFramingDetector {
         val span = ByteSpan(input)
         var length = span.length
 
-        // Handle comma-separated: take first segment
+        // Handle comma-separated: take first segment, without the OWS before its comma ("5 ,5" is 5)
         val comma = span.indexOfByte(','.code, 0, length)
         if (comma >= 0)
             length = comma
+        while (length > 0 && (span.at(length - 1) == ' '.code || span.at(length - 1) == '\t'.code))
+            length--
 
         if (length == 0) return -1
 
@@ -147,7 +149,11 @@ public object BodyFramingDetector {
             val b = span.at(j)
             if (b < '0'.code || b > '9'.code) return -1
             result = result * 10 + (b - '0'.code)
-            if (result < 0) return -1 // overflow
+            // 2^63 and up: longer than any body may be, so refused as too large rather than read as no body
+            if (result < 0) {
+                for (k in j + 1 until length) if (span.at(k) < '0'.code || span.at(k) > '9'.code) return -1
+                return Long.MAX_VALUE
+            }
         }
 
         return result

glyph11/src/test/kotlin/Glyph11HardeningTests.kt

@@ -6,6 +6,8 @@ import ktron.glyph11.parser.ParserLimits
 import ktron.glyph11.parser.ultrahardened.UltraHardenedParser
 import ktron.glyph11.protocol.BinaryRequest
 import ktron.glyph11.protocol.BinaryResponse
+import ktron.glyph11.validation.BodyFraming
+import ktron.glyph11.validation.BodyFramingDetector
 import ktron.glyph11.validation.ChunkedBodyValidator
 import java.nio.ByteBuffer
 import kotlin.test.Test
@@ -116,4 +118,38 @@ class Glyph11HardeningTests {
         // the validator added the size to its position and overflowed: it took the chunk's data for the next size line
         assertEquals(-1, ChunkedBodyValidator.tryValidate(ByteBuffer.wrap(huge)))
     }
+
+    // ---- a Content-Length the checks accept frames that length: framed as no body, the body would be read as the
+    // next request ----
+
+    // value -> the length it frames
+    private val listedLengths = listOf(
+        "5 ,5" to 5L, "5\t, 5" to 5L, "5 , 5 " to 5L, "5 ,5\r\nContent-Length: 5 ,5" to 5L,
+        "9223372036854775807" to Long.MAX_VALUE,
+        "9223372036854775808" to Long.MAX_VALUE, "9999999999999999999" to Long.MAX_VALUE,
+        "18446744073709551615" to Long.MAX_VALUE, "9223372036854775808, 9223372036854775808" to Long.MAX_VALUE,
+    )
+
+    @Test
+    fun `OWS before a list's comma and lengths of 2^63 and up still frame a length`() {
+        for ((value, length) in listedLengths) {
+            val request = bytes("POST / HTTP/1.1\r\nHost: x\r\nContent-Length: $value\r\n\r\n")
+            val head = RequestHead()
+            assertEquals(request.size, Glyph11.parse(request, 0, request.size, head), value)
+            assertEquals(RequestHead.BODY_LENGTH, head.bodyFraming, value)
+            assertEquals(length, head.contentLength, value)
+        }
+    }
+
+    @Test
+    fun `the ByteBuffer API frames them the same`() {
+        for ((value, length) in listedLengths) {
+            val request = BinaryRequest()
+            val bytes = ByteBuffer.wrap(bytes("POST / HTTP/1.1\r\nHost: x\r\nContent-Length: $value\r\n\r\n"))
+            UltraHardenedParser.tryExtractFullHeader(bytes, request, ParserLimits.Default)
+            val framing = BodyFramingDetector.detectBodyFraming(request)
+            assertEquals(BodyFraming.ContentLength, framing.framing, value)
+            assertEquals(length, framing.contentLength, value)
+        }
+    }
 }