From f50e4dd0813da9300580f7188e44ed72a27ae79c Mon Sep 17 00:00:00 2001
From: Nick Peng <pymumu@gmail.com>
Date: Fri, 27 Aug 2021 19:14:49 +0800
Subject: [PATCH] Revert "http: Fix http overflow bug"

This reverts commit ea8c1f47f8b8e5ec2da47e3d0904fa3dd75550dc.
---
 src/http_parse.c | 50 ++++++++++++++++--------------------------------
 src/http_parse.h |  2 --
 2 files changed, 17 insertions(+), 35 deletions(-)

diff --git a/src/http_parse.c b/src/http_parse.c
index b688723..5590632 100644
--- a/src/http_parse.c
+++ b/src/http_parse.c
@@ -191,11 +191,6 @@ int http_head_get_data_len(struct http_head *http_head)
 	return http_head->data_len;
 }
 
-int http_head_buff_len(struct http_head *http_head) 
-{
-	return http_head->buff_len;
-}
-
 static int _http_head_add_fields(struct http_head *http_head, char *name, char *value)
 {
 	unsigned long key = 0;
@@ -377,6 +372,7 @@ int http_head_parse(struct http_head *http_head, const char *data, int data_len)
 	int i = 0;
 	char *buff_end = NULL;
 	int left_size = 0;
+	int process_data_len = 0;
 
 	left_size = http_head->buff_size - http_head->buff_len;
 
@@ -388,15 +384,18 @@ int http_head_parse(struct http_head *http_head, const char *data, int data_len)
 	if (http_head->head_ok == 0) {
 		for (i = 0; i < data_len; i++, data++) {
 			*(buff_end + i) = *data;
-			http_head->buff_len++;
-			if (http_head->buff_len > 1 && *(buff_end + i - 1) == '\r' && *(buff_end + i) == '\n') {
-				if (http_head->buff_len < 4) {
+			if (*data == '\n') {
+				if (http_head->buff_len + i < 2) {
 					continue;
 				}
 
 				if (*(buff_end + i - 2) == '\n') {
 					http_head->head_ok = 1;
-					http_head->head_len = http_head->buff_len + i - 1;
+					http_head->head_len = http_head->buff_len + i - 2;
+					i++;
+					buff_end += i;
+					data_len -= i;
+					data++;
 					if (_http_head_parse(http_head) != 0) {
 						return -2;
 					}
@@ -413,51 +412,36 @@ int http_head_parse(struct http_head *http_head, const char *data, int data_len)
 						return -2;
 					}
 
-					i++;
-					buff_end += i;
-					data_len -= i;
-					data++;
 					break;
 				}
 			}
 		}
 
+		process_data_len += i;
 		if (http_head->head_ok == 0) {
 			// Read data again */
+			http_head->buff_len += process_data_len;
 			return -1;
 		}
 	}
 
-	if (http_head->head_ok == 1 && data_len > 0) {
+	if (http_head->head_ok == 1) {
 		int get_data_len = (http_head->expect_data_len > data_len) ? data_len : http_head->expect_data_len;
-		if (http_head->expect_data_len == 0) {
-			get_data_len  = data_len;
-		}
 		if (http_head->data == NULL) {
 			http_head->data = buff_end;
 		}
 
 		memcpy(buff_end, data, get_data_len);
+		process_data_len += get_data_len;
 		http_head->data_len += get_data_len;
-		http_head->buff_len += get_data_len;
-		if (http_head->expect_data_len > 0) {
-			http_head->expect_data_len -= get_data_len;
-			if (http_head->expect_data_len == 0) {
-				return http_head->buff_len;
-			}
-		}
-		if (http_head->data_len < http_head->expect_data_len) {
-			return -1;
-		}
-	} else {
+	}
+
+	http_head->buff_len += process_data_len;
+	if (http_head->data_len < http_head->expect_data_len) {
 		return -1;
 	}
 
-	if (http_head->expect_data_len == 0) {
-		return -1;
-	}
-
-	return 0;
+	return process_data_len;
 }
 
 void http_head_destroy(struct http_head *http_head)
diff --git a/src/http_parse.h b/src/http_parse.h
index d5c7f4f..8aa66ae 100644
--- a/src/http_parse.h
+++ b/src/http_parse.h
@@ -61,8 +61,6 @@ char *http_head_get_data(struct http_head *http_head);
 
 int http_head_get_data_len(struct http_head *http_head);
 
-int http_head_buff_len(struct http_head *http_head);
-
 struct http_head_fields *http_head_first_fields(struct http_head *http_head);
 
 struct http_head_fields *http_head_next_fields(struct http_head_fields *fields);