Lighttpd

The bug is old (in connections.c connection_handle_read_state()), but recent changes made it occur more often; the following patch fixes that.

Right now the bug triggers at the 64-byte boundary, the patch should make it occur somewhere at 4k or more.

diff --git a/src/connections.c b/src/connections.c
index 7e205af..46e46b1 100644
--- a/src/connections.c
+++ b/src/connections.c
@@ -336,10 +336,11 @@ static int connection_handle_read(server *srv, connection *con) {
     len = recv(con->fd, mem, mem_len, 0);
 #else /* __WIN32 */
     if (ioctl(con->fd, FIONREAD, &toread) || toread == 0 || toread <= 4*1024) {
-        if (toread > MAX_READ_LIMIT) toread = MAX_READ_LIMIT;
-    } else {
         toread = 4096;
     }
+    else if (toread > MAX_READ_LIMIT) {
+        toread = MAX_READ_LIMIT;
+    }
     chunkqueue_get_memory(con->read_queue, &mem, &mem_len, 0, toread);

     len = read(con->fd, mem, mem_len);

r2979 introduced the bug; the local code looks like it could end up triggering an out-of-bounds read, but I couldn't find a way to trigger it; I think the allocation pattern prevents it: we only search for at most 3 bytes in the next buffer, and the previous buffer would have to be smaller than that, in which case we would have reused the previous buffer for the following data.