Lighttpd

what i dont like about this patch is that it limits the number to 65535. while this might be ok for your use case (server.port) this is not a valid solution for the problem. what if i want to set the max request size from the environment?

the number shouldnt be limited at that position but checked later on in the code if it fits into the limits in this scope.

The hard-coded limit of 65535 is completely justified.

The case in question is for "T_CONFIG_SHORT", which generally suggests that a two-byte signed (or unsigned) value is wanted. This is confirmed, and the signed-vs-unsigned question is settled, a few lines further on, where an error message has the 65535 value hard-coded in. Good design dictates that the numeric limits of the lighty config language should be platform independent, not determined by the built-in types of the C compiler used to build it (ie, we don't really want 65536 overflowing on one platform but not on another). All the C standards I've ever read say that `sizeof(short)` is guaranteed to be at least two on all architectures. So I deduced that the assumption of two-byte shorts was deliberate on the part of the lighty developers, and respected that.

Incidentaly, Just a few lines higher, data_integer.value (which is of type int) is assigned to a `*(unsigned short *)` without checking for overflow. That is clearly a bug, but it further strengthens my argument.

-- andrewb

Is this going to be fixed any time soon? The patch looks OK to me (if not, it's trivial to #define the maximum unsigned short as (1 << (sizeof(unsigned short) * 8)) - 1), and I just ran into this problem today myself.

Workaround: have a shell script that does this for you:

#!/bin/sh

echo "server.port = ${PORT}"