Reject invalid or out-of-range Content-Length
contentLength() narrowed toULongLong()'s result straight into a qint64,
so a Content-Length above the qsizetype maximum wrapped to a negative
value. That made the "bodyLength > 0" body-size gate in readHeader()
skip, and the request was routed to AllDone with no body consumed,
leaving the declared body on the wire to be parsed as the next request.
A non-numeric or negative Content-Length was likewise treated as "no
body" rather than rejected.
Validate the field: an absent Content-Length is still treated as no
body, but a value that is non-numeric, negative, or larger than a
QByteArray can hold cannot be a valid body length, so reject the
request with 400 (Bad Request). This is decided in contentLength()
before the body-size gate, so it does not depend on the configured
maximum body size.
[ChangeLog][QHttpServerParser] A request with a malformed
Content-Length (non-numeric, negative, or too large to represent)
is now rejected with 400 (Bad Request) over HTTP/1.Previously such
a value was ignored and the request processed as if it had no body.
Fixes: QTBUG-150275
Pick-to: 6.12 6.12.0
Change-Id: Ia2ac698bdd331509ea89b0a844ef4ce4c226a839
Reviewed-by: MÃ¥rten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Lena Biliaieva <lena.biliaieva@qt.io>