[ipxe-devel] [PATCH] Format HTTP Range with unsigned long long

[Linus Lüssing]

Hi Geert,

Thanks for the patch. I had tried this approach unsuccessfully
before writing my initial mail. It seems that the custom
snprintf() implementation provided by core/vsprintf.c does not
support the "u" format option yet.

Maybe another issue, but I'm also confused about the type_sizes[]
array in vsprintf.c, I don't think that a size_t is necessarilly
greater or equal to a "long long", is it?

Regards, Linus

PS: I know, my mail address does not have an SPI record. But I
would prefer if you were not sending mails in a way which would
appear to others as if I had sent it. Use a separate "From: ..."
in the mail body instead, "git am" can handle that just fine.
Or use a "Reported-by: Linus Lüsssing ..." in the end instead and
leave the "From:" intact with your address.


On Wed, May 24, 2017 at 07:45:29AM +0200, Linus Lüssing wrote:
> With an ISO 3076767744 bytes large, the menu loads fine.
> However booting the live image itself fails.
> 
> Looking at the HTTP exchange with Wireshark, it was noticed
> that the HTTP Get Requests upon trying to boot the live
> image option in its menu makes ipxe create a broken "Range:"
> header. It looks like:
> 
> "Range: -x--y"
> 
> Which the nginx obviously responds to with a "HTTP/1.1 416
> Requested Range Not Satisfiable".
> 
> The "%zd" in http_format_range() is causing an integer overflow,
> causing these negative numbers. %zd -> 2*31 = 2GB max.
> 
> Replaced the "%zd" with "%llu"
> ---
>  src/net/tcp/httpcore.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/src/net/tcp/httpcore.c b/src/net/tcp/httpcore.c
> index 4a1300c..707ca59 100644
> --- a/src/net/tcp/httpcore.c
> +++ b/src/net/tcp/httpcore.c
> @@ -917,7 +917,7 @@ static int http_format_range ( struct http_transaction *http,
>  
>  	/* Construct range, if applicable */
>  	if ( http->request.range.len ) {
> -		return snprintf ( buf, len, "bytes=%zd-%zd",
> +		return snprintf ( buf, len, "bytes=%llu-%llu",
>  				  http->request.range.start,
>  				  ( http->request.range.start +
>  				    http->request.range.len - 1 ) );
> -- 
> 2.0.0
>