[Bug-wget] wget 1.12 segfaults on malformed response from https proxy

[Von Welch]

I'm using an HTTPS proxy that is returning a malformed response to initial
CONNECT command, which is causing wget (1.12, built from source) to segfault
consistently on MacOSX 10.6.8. Debug output and stack trace follow.

Von


% wget -d https://encrypted.google.com
DEBUG output created by Wget 1.12 on darwin10.2.0.

URI encoding = “UTF-8”
URI encoding = “UTF-8”
--2011-08-01 23:07:46--  https://encrypted.google.com/
Resolving localhost (localhost)... 127.0.0.1, ::1, fe80::1
Caching localhost => 127.0.0.1 ::1 fe80::1
Connecting to localhost (localhost)|127.0.0.1|:8000... connected.
Created socket 3.
Releasing 0x000000010041e6e0 (new refcount 1).

---request begin---
CONNECT encrypted.google.com:443 HTTP/1.0
User-Agent: Wget/1.12 (darwin10.2.0)

---request end---
proxy responded with: [HTTP/1.1 %s %s

]
Segmentation fault


(gdb) run https://encrypted.google.com
Starting program: /private/tmp/wget-1.12/src/wget
https://encrypted.google.com
Reading symbols for shared libraries +++... done
--2011-08-01 23:28:11--  https://encrypted.google.com/
Resolving localhost... 127.0.0.1, ::1, fe80::1
Connecting to localhost|127.0.0.1|:8000... connected.

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000000
0x00007fff855c5c00 in strlen ()
(gdb) bt
#0  0x00007fff855c5c00 in strlen ()
#1  0x000000010003e941 in xstrdup ()
#2  0x000000010001b67a in gethttp (u=0x100100140, hs=0x7fff5fbfedc0,
dt=0x7fff5fbff258, proxy=0x100100220, iri=0x100068580) at http.c:1744
#3  0x000000010001dddd in http_loop (u=0x100100140, newloc=0x7fff5fbff088,
local_file=0x7fff5fbff068, referer=0x0, dt=0x7fff5fbff258,
proxy=0x100100220, iri=0x100068580) at http.c:2581
#4  0x000000010002b1e8 in retrieve_url (orig_parsed=0x100100140,
origurl=0x100100120 "https://encrypted.google.com";, file=0x7fff5fbff218,
newloc=0x7fff5fbff210, refurl=0x0, dt=0x7fff5fbff258, recursive=false,
iri=0x100068580, register_status=true) at retr.c:692
#5  0x0000000100024ddb in main (argc=2, argv=0x7fff5fbff2c8) at main.c:1294