httpd.c headers handling

[Giuseppe Ciotta]

in httpd.c sendCgi():

#ifndef PIPE_BUF
# define PIPESIZE 4096          /* amount of buffering in a pipe */
#else
# define PIPESIZE PIPE_BUF
#endif
#if PIPESIZE >= MAX_MEMORY_BUFF
# error "PIPESIZE >= MAX_MEMORY_BUFF"
#endif

	// There is something to read
	count = safe_read(inFd, rbuf, PIPESIZE);
	if (count == 0)
		break;  /* closed */
	if (count > 0) {
	  if (firstLine) {
	    rbuf[count] = 0;
	    /* check to see if the user script added headers */
	    if(strncmp(rbuf, "HTTP/1.0 200 OK\r\n", 4) != 0) {
	      bb_full_write(s, "HTTP/1.0 200 OK\r\n", 17);
	    }
	    if (strstr(rbuf, "ontent-") == 0) {
	      bb_full_write(s, "Content-type: text/plain\r\n\r\n", 28);
	    }
	    firstLine = 0;
	  }
	  if (bb_full_write(s, rbuf, count) != count)
	      break;

basically from what i understand this piece of code reads up to
PIPESIZE from the cgi stdout, then it looks for the first http header,
adding it when needed, then it searches for the "ontent-" and adds
Content-type: as last (\r\n\r\n) http header when needed.

httpd uses safe_read which means chances are that it will not read all
of the cgi headers.

This means the following has a higher percentange of success

#!/bin/sh                                                                       
echo -e "HTTP/1.0 302 OK\r\nContent-type: text/plain\r"                         
echo -e "Status: 302 Moved\r"                                                   
echo -e "Location: http://www.google.com/\r"                                    
echo -e "\r"                                                                    

than this:

#!/bin/sh                                                                       
echo -e "HTTP/1.0 302 OK\r"
echo -e "Content-type: text/plain\r"                         
echo -e "Status: 302 Moved\r"                                                   
echo -e "Location: http://www.google.com/\r"                                    
echo -e "\r"                                                                    

In response to the second cgi, httpd often sends:

~$ echo get /cgi-bin/index.cgi |nc 192.168.72.47 80
Content-type: text/plain

HTTP/1.0 302 OK
Content-type: text/plain
Status: 302 Moved
Location: http://www.google.com/

Which is wrong, as the first 2 lines end http headers.

What i think is that httpd should not deal with Content-type header,
since this should be handled by the cgi itself. 
What do you think about it?

-- 
Giuseppe Ciotta
(string 99 105 97 111)