jpegqs

Yes, that's a vulnerability, I have fixed it on github.

Thanks for noticing this, I fixed it on github. However, it seems that browsers are simply ignoring CRs. So that "\n\n" is enough.

Thanks, I forgot about that. It would be very helpful to have some extra space for fixes.

Good point, I need add something like b[3]='.', an then use b+3 as a path, not b+5, to fix that vulnerability.

Update: I fixed this on github.

I can explain it:

  m = n
    ? /* if (n != 0) */
      /* adds index.html if path ends with "/" (means the filename is omitted), otherwise copies zero */
      strcpy(b+i-1,b[i-2]-'/'?"":"index.html"),
      /* log the requested filename to stdout */
      printf("%s\n",b+5),
      /* if "/." is in the path or an error occurred while opening the file */
      strstr(b,"/.")||!(f=fopen(b+5,"rb"))
        ? "404 Not Found"
        : "200 OK"
    : "501 Not Implemented"; /* if (n == 0) */

By filtering filenames with "/." I prevent exploits with ".." and also don't allow to read files starting with a dot, these are hidden files in Unix-like OS.

It's calculated that strcpy() should never cause a buffer overflow here.

I tried to make it secure and protect from such things. If someone finds vulnerabilities, please let me know.

I have provided protection against this.

It's cool if you can read code like this without issue. I'm chasing Kolmogorov complexity, rather than obfuscation. I add things like this to fill gaps in a specific shape.

This is what I am arguing about with another IOCCC winner. What can be called obfuscation, and where are its boundaries.

Can be both, a string and a function:

         char main
         [/*x86*/]
       __attribute__
    ((section(".text"))
   )="WTYH)9Zj8_j7H)9]R"
  "H)9^\350\0\0\0\0H)1^R"
   "H))Z8<2u\366j<)9Xj9"
   ")9j9VY)<$[S_H\xbd^["
    "H$@\xcd\200-XP\xf"
    "\5XP_j<W\xeb\xe2]"
     "Hello World!\n";
      /*Linux_Only!*/

Location: Novosibirsk, Russia

Remote: Yes

Willing to relocate: Probably not

Technologies: C/Assembly, SIMD (SSE/AVX/NEON/HVX and others), OpenCL, OpenMP

Résumé/CV: https://www.linkedin.com/in/ilya-kurdyukov-a7304119b/

Github: https://github.com/ilyakurdyukov/

Email: jpegqs at gmail com

I specialize in optimizing code to achieve better performance (especially in image processing).

The better way to check for buffer overflow here is "((unsigned T)i < n)".

But the "(i >= 0 && i < n)" way that I used in this example - I have seen many times.

So hackers can scan open source software compiled with GCC for such issue and can exploit this vulnerability, since GCC developers will not fix it.

Thank you, I didn't know about this compiler option.

Checked that the code works as expected with this option.

I know, but the point is to make the compiler more predictable, and therefore better. For example, CLANG doesn't have this issue.

And this is related to a possible security vulnerability, so it should be taken more seriously.

Ok, but isn't that the same as saying that if the manufacturer guarantees that the product you purchased will work for two years, then it may break immediately two years after purchase, and you cannot complain about that, because this behavior is completely legal.

Location: Novosibirsk, Russia

Remote: Yes

Willing to relocate: Probably not

Technologies: C/Assembly, SIMD (SSE/AVX/NEON/HVX and others), OpenCL, OpenMP

Résumé/CV: https://www.linkedin.com/in/ilya-kurdyukov-a7304119b/

Github: https://github.com/ilyakurdyukov/

Email: jpegqs at gmail com

I specialize in optimizing code to achieve better performance (especially in image processing).