AnyEvent::HTTP handling invalid chunked response

Zsbán Ambrus ambrus at math.bme.hu
Fri May 29 23:50:09 CEST 2015


Hello.

Tyemq just told me that he was frustrated by HTTP libraries in perl
because most of them have a problem with invalid chunked HTTP
responses.  Specifically, if the server sends an infinite string of
digits where a chunk length is expected, they will keep the whole
string in memory until the program runs out of memory and probably
blows up.

I've tried to look at the source code of AnyEvent::HTTP (version 2.22)
for whether it also does this.  It seems that AnyEvent::HTTP probably
also has this problem: it will keep an arbitrarily long line of text
in memory where a chunk length is expected, and further, it will keep
an arbitrarily large chunk in memory even if it could call the body
callback before that.  Does AnyEvent::HTTP really do this, or am I
reading it wrong?  If it does this, then is there a chance you could
fix this please?

-- Ambrus



More information about the anyevent mailing list