From 1a38e910422b82b1b068bb1632dcc5a88da38e22 Mon Sep 17 00:00:00 2001
From: Sergey Lyubka <lsm@cesanta.com>
Date: Fri, 12 Jul 2019 10:23:36 +0100
Subject: [PATCH] Next

PUBLISHED_FROM=6fa0be81ce429b8db9e3ed572cb4a876b6fb2693
---
 mongoose.c    | 2 +-
 src/mg_http.c | 2 +-
 test/Makefile | 6 +++++-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/mongoose.c b/mongoose.c
index 22da9a51..5c800075 100644
--- a/mongoose.c
+++ b/mongoose.c
@@ -6289,7 +6289,7 @@ int mg_parse_http(const char *s, int n, struct http_message *hm, int is_req) {
     }
   } else {
     s = mg_skip(s, end, " ", &hm->proto);
-    if (end - s < 4 || s[3] != ' ') return -1;
+    if (end - s < 4 || s[0] < '0' || s[0] > '9' || s[3] != ' ') return -1;
     hm->resp_code = atoi(s);
     if (hm->resp_code < 100 || hm->resp_code >= 600) return -1;
     s += 4;
diff --git a/src/mg_http.c b/src/mg_http.c
index 9e9d761c..2751d51d 100644
--- a/src/mg_http.c
+++ b/src/mg_http.c
@@ -455,7 +455,7 @@ int mg_parse_http(const char *s, int n, struct http_message *hm, int is_req) {
     }
   } else {
     s = mg_skip(s, end, " ", &hm->proto);
-    if (end - s < 4 || s[3] != ' ') return -1;
+    if (end - s < 4 || s[0] < '0' || s[0] > '9' || s[3] != ' ') return -1;
     hm->resp_code = atoi(s);
     if (hm->resp_code < 100 || hm->resp_code >= 600) return -1;
     s += 4;
diff --git a/test/Makefile b/test/Makefile
index b3457bf9..7bf70a10 100644
--- a/test/Makefile
+++ b/test/Makefile
@@ -17,7 +17,7 @@ else
 COMMON_PARENT = $(SRC_DIR)
 endif
 
-TEST_SOURCES = unit_test.c test_util.c test_main.c
+TEST_SOURCES = unit_test.c test_util.c test_main.c fuzz.c
 AMALGAMATED_SOURCES = ../mongoose.c
 KRYPTON_PATH = $(REPO_ROOT)/krypton
 
@@ -118,6 +118,10 @@ clean_index_cgi:
 	@echo -e "CLEAN\tindex.cgi"
 	@rm -f data/cgi/index.cgi*
 
+fuzz:
+	$(CC) fuzz.c ../mongoose.c -o /tmp/$@ -fsanitize=fuzzer,address -g -I..
+	/tmp/$@
+
 # Interactive:
 #   docker run -v $(CURDIR)/../..:/cesanta -t -i --entrypoint=/bin/bash cesanta/mongoose_test
 docker: