Description
uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line, such as a size exceeding INT_MAX, then clears `r->content_length` and `r->transfer_chunked` without draining the remaining body or setting `request.connection_close`. The completion check treats the chunked POST as finished and the keep-alive parser returns to `CLIENT_STATE_INIT`. Attacker-controlled body bytes aligned as a complete HTTP request are then parsed and processed as another request on the same connection, causing HTTP request smuggling and request-boundary desynchronization. Commits b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690 patch the issue.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
openwrt uhttpd
>= b7c85a2819b3869279a669d5681f574824589c6c, < b78f518478794e16ba3568fc1258e40bf3e8eb3baffected>= b7c85a2819b3869279a669d5681f574824589c6c, < 34460b8211d676ef1b9f40d6b775c5e112933690affected