1

in This block of code an int field is defined and initialized to 0 in order to count the number of fields present in the HTTP request; However, it's not used afterward. And it's value is checked to make sure the Maximum number of fields is not exceeded,but the value itself was not updated in the first place; I was expecting to see "field++; " in the code somewhere afterward. So did I miss something or is it a mistake in the source code itself ?

 int fields = 0;
        haystack = needle + 2;
        while (*haystack != '\0')
        {
            // look for CRLF
            needle = strstr(haystack, "\r\n");
            if (needle == NULL)
            {
                break;
            }

            // ensure field is no longer than LimitRequestFieldSize
            if (needle - haystack + 2 > LimitRequestFieldSize)
            {
                break;
            }

            // look beyond CRLF
            haystack = needle + 2;
        }

        // if we didn't get to end of message, we must have erred
        if (*haystack != '\0')
        {
            break;
        }

        // ensure message has no more than LimitRequestFields
        if (fields > LimitRequestFields)
        {
            break;
        }

        // valid
        return true;
    }
  • Thank you for posting - I thought I was seriously missing the point when reading that code. Do we think they might update the source code? – Freya H - MSFT Oct 20 '16 at 22:54
  • I think we should tell someone from the staff so they can correct and update it – A.Emad Oct 21 '16 at 16:01
1

While this isn't technically a support request, you seem to be right. Although fields is initialized, and later checked, it is never once mentioned in between.

// count fields in message
int fields = 0;

// ...

// ensure message has no more than LimitRequestFields
if (fields > LimitRequestFields)
{
    break;
}
| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .