lws_get_urlarg_by_name: drop candidates that wont fit in buf rather than bail

#3227

Author: lws-team

include/libwebsockets/lws-http.h

@@ -436,7 +436,7 @@ lws_hdr_copy(struct lws *wsi, char *dest, int len, enum lws_token_indexes h);
 /**
  * lws_hdr_copy_fragment() - copy a single fragment of the given header to a buffer
  *		The buffer length len must include space for an additional
- *		terminating '\0', or it will fail returning -1.
+ *		terminating '\0', or it will fail returning -2.
  *		If the requested fragment index is not present, it fails
  *		returning -1.
  *

lib/core-net/wsi.c

@@ -746,10 +746,11 @@ lws_get_urlarg_by_name_safe(struct lws *wsi, const char *name, char *buf, int le
 		fraglen = lws_hdr_copy_fragment(wsi, buf, len,
 						WSI_TOKEN_HTTP_URI_ARGS, n);
 
-		if (fraglen < 0)
+		if (fraglen == -1) /* no fragment or basic problem */
 			break;
 
-		if (fraglen + 1 < len &&
+		if (fraglen > 0 && /* fragment could fit */
+		    fraglen + 1 < len &&
 		    fraglen >= sl &&
 		    !strncmp(buf, name, (size_t)sl)) {
 			/*

lib/roles/http/parsers.c

@@ -520,7 +520,7 @@ int lws_hdr_copy_fragment(struct lws *wsi, char *dst, int len,
 	}
 
 	if (wsi->http.ah->frags[f].len >= len)
-		return -1;
+		return -2;
 
 	memcpy(dst, wsi->http.ah->data + wsi->http.ah->frags[f].offset,
 	       wsi->http.ah->frags[f].len);