Fix to return an error response when multiple content-lengths headers are present.

Author: mopemope

meinheld/server/http_parser.c

@@ -115,7 +115,7 @@ do {                                                                 \
     FOR##_mark = NULL;                                               \
   }                                                                  \
 } while (0)
-  
+
 /* Run the data callback FOR and consume the current byte */
 #define CALLBACK_DATA(FOR)                                           \
     CALLBACK_DATA_(FOR, p - FOR##_mark, p - data + 1)
@@ -1389,7 +1389,7 @@ size_t http_parser_execute (http_parser *parser,
         }
 
         c = LOWER(ch);
-        
+
         switch (parser->header_state) {
           case h_upgrade:
             parser->flags |= F_UPGRADE;
@@ -1410,8 +1410,13 @@ size_t http_parser_execute (http_parser *parser,
               SET_ERRNO(HPE_INVALID_CONTENT_LENGTH);
               goto error;
             }
+            if (parser->set_content_length > 0) {
+              SET_ERRNO(HPE_INVALID_CONTENT_LENGTH);
+              goto error;
+            }
 
             parser->content_length = ch - '0';
+            parser->set_content_length = 1;
             break;
 
           case h_connection:
@@ -1449,7 +1454,7 @@ size_t http_parser_execute (http_parser *parser,
         }
 
         c = LOWER(ch);
-        
+
         switch (parser->header_state) {
           case h_general:
             break;

meinheld/server/http_parser.h

@@ -141,7 +141,7 @@ enum flags
 
 
 /* Map for errno-related constants
- * 
+ *
  * The provided argument should be a macro that takes 2 arguments.
  */
 #define HTTP_ERRNO_MAP(XX)                                           \
@@ -214,6 +214,7 @@ struct http_parser {
 
   uint32_t nread;          /* # bytes read in various scenarios */
   uint64_t content_length; /* # bytes in body (0 if no Content-Length header) */
+  unsigned char set_content_length;
 
   /** READ-ONLY **/
   unsigned short http_major;