http.c: Fix attack vector on PUT requests

Without the fix, a malicious user could perform a large number of PUT
requests to any endpoint, regardless of being correct or not, so that
libweb would allocate a large number of temporary files without removing
them, eventually exhausting the system resources.

1 files changed, 5 insertions, 1 deletions

diff --git a/http.c b/http.c
index 6410192..806171d 100644
--- a/http.c
+++ b/http.c
@@ -649,7 +649,11 @@ static void ctx_free(struct ctx *const c)
             fprintf(stderr, "%s: fclose(3) p->f: %s\n",
                 __func__, strerror(errno));
 
-        free(c->u.put.tmpname);
+        if (p->tmpname && remove(p->tmpname) && errno != ENOENT)
+                fprintf(stderr, "%s: remove(3) %s: %s\n",
+                    __func__, p->tmpname, strerror(errno));
+
+        free(p->tmpname);
     }
 
     free(c->field);