Content-Length with obsolete line folding is accepted with invalid input

[obatysh]

According to https://tools.ietf.org/html/rfc7230#section-3.2.4
requests/responses with obsolete line folding can be rejected or obs-fold can be treated as one or more spaces.
obs-fold = CRLF 1*( SP / HTAB )

Currently any input after an obsolete line folding in Content-Length field would be accepted.
Example request:
"POST / HTTP/1.1\r\n"
"Content-Length: 42\r\n"
" ANY TEXT\r\n" // would be accepted and reported as part of Content-Length header field value
"\r\n"
...

[indutny]

I think this should yield HPE_UNEXPECTED_CONTENT_LENGTH error. Is there a test case that would demonstrate that it behaves differently?

Thanks for reporting this!

[obatysh]

There is no test yet, and it was reporting error before the commit 01da95f was introduced.

The issue happens because after obsolete line folding is discovered the parser goes back to s_header_value_start. But as new content length states h_content_length_num, h_content_length_ws are not handled there it goes to default case and h_general state.

[indutny]

Thank you for checking it. Your analysis of the code path is absolutely correct! Did I understand it right, that after 01da95f the bug is no longer reproducible?

[obatysh]

No, vice versa, the bug appears after
01da95f

[indutny]

@obatysh would you care to clarify if this error is actually reproducible and you experienced it?

[indutny]

Nevermind, I can reproduce it now.