_nx_web_http_server_field_value_get() searches the complete HTTP request packet for header fields instead of restricting the search to the HTTP header section.
According to HTTP/1.1, header parsing must stop after the first \r\n\r\n sequence, which marks the end of the header. The message body is opaque binary data and must not be interpreted as additional HTTP headers.
However, _nx_web_http_server_field_value_get() continues scanning the request beyond the header boundary. Consequently, header names contained in the request body can be returned as valid HTTP header fields.
One observed consequence is that _nx_web_http_server_chunked_check() may incorrectly detect Transfer-Encoding: chunked although the HTTP request only contains a Content-Length header and the request body happens to contain the string Transfer-Encoding: chunked.
Bugfix:
Restrict the search in _nx_web_http_server_field_value_get() to the HTTP header region only. Stopping the scan at the offset returned by _nx_web_http_server_calculate_content_offset() resolves the issue.
_nx_web_http_server_field_value_get() searches the complete HTTP request packet for header fields instead of restricting the search to the HTTP header section.
According to HTTP/1.1, header parsing must stop after the first \r\n\r\n sequence, which marks the end of the header. The message body is opaque binary data and must not be interpreted as additional HTTP headers.
However, _nx_web_http_server_field_value_get() continues scanning the request beyond the header boundary. Consequently, header names contained in the request body can be returned as valid HTTP header fields.
One observed consequence is that _nx_web_http_server_chunked_check() may incorrectly detect Transfer-Encoding: chunked although the HTTP request only contains a Content-Length header and the request body happens to contain the string Transfer-Encoding: chunked.
Bugfix:
Restrict the search in _nx_web_http_server_field_value_get() to the HTTP header region only. Stopping the scan at the offset returned by _nx_web_http_server_calculate_content_offset() resolves the issue.