Replace strchr and strstr with safer variants

Author: mkochenough

src/Makefile.am

@@ -12,6 +12,8 @@ pcap_http_analyzer_SOURCES = \
     print.h\
     tcp.h \
     tcp.cc \
+    utils.h \
+    util.cc \
     websocket.cc \
     websocket.h
 pcap_http_analyzer_CPPFLAGS = $(JSON_CFLAGS)

src/main.cc

@@ -14,6 +14,7 @@
 #include "commparty.h"
 #include "print.h"
 #include "tcp.h"
+#include "util.h"
 #include "websocket.h"
 
 using namespace std;
@@ -97,7 +98,7 @@ void printTimestamp(struct timeval tv) {
 void printHttpRequestTitle(const Buffer& buffer) {
   printf("ht ");
   const char* data = buffer.getData();
-  const char* eol_char = strchr(data, '\r');
+  const char* eol_char = strnchr(data, '\r', buffer.getLength());
 
   if (!eol_char) {
     printf("DATA\n");
@@ -153,7 +154,7 @@ void handleHttpResponse(const Buffer& buffer) {
     printf("\n");
     const char* data = buffer.getData();
     int len = buffer.getLength();
-    const char* bodySeparator = strstr(data, "\r\n\r\n");
+    const char* bodySeparator = strnstr(data, "\r\n\r\n", len);
 
     if (bodySeparator) {
       printIndented(4, data, bodySeparator - data);

src/print.cc

@@ -3,24 +3,10 @@
 #endif /* HAVE_CONFIG_H */
 
 #include "print.h"
+#include "util.h"
 
-#include <stdio.h>
-#include <stdlib.h>
 #include <string.h>
 
-const char* strnchr(const char *str, size_t len, int character) {
-  const char* end = str + len;
-  char c = (char) character;
-
-  do {
-    if (*str == c) {
-      return str;
-    }
-  } while (++str < end);
-
-  return NULL;
-}
-
 void printIndent(int indent) {
   for (int index = 0; index < indent; index++) {
     printf(" ");

src/util.cc

@@ -0,0 +1,42 @@
+#include "util.h"
+
+#include <string.h>
+
+const char* strnchr(const char* str, size_t len, int character) {
+  const char* end = str + len;
+  char c = (char) character;
+
+  do {
+    if (*str == c) {
+      return str;
+    }
+  } while (++str < end);
+
+  return NULL;
+}
+
+const char* strnstr(const char* str, const char* find, size_t len)
+{
+  char c, sc;
+  size_t flen;
+
+  if ((c = *find++) != '\0') {
+    flen = strlen(find);
+
+    do {
+      do {
+	if (len-- < 1 || (sc = *str++) == '\0') {
+	  return NULL;
+	}
+      } while (sc != c);
+
+      if (flen > len) {
+	return NULL;
+      }
+    } while (strncmp(str, find, flen) != 0);
+
+    str--;
+  }
+
+  return ((char*) str);
+}

src/util.h

@@ -0,0 +1,9 @@
+#ifndef __UTIL_H__
+#define __UTIL_H__
+
+#include <stdlib.h>
+
+const char* strnchr(const char* str, size_t len, int character);
+const char* strnstr(const char* str, const char* find, size_t len);
+
+#endif /* __UTIL_H__ */