string.h find() reports a match when only a PREFIX of the needle occurs at the
end of the buffer.
Repro: string_t("4\r").find("\r\n") returns a non-null ptr [1,2] — a match for
"\r\n" even though only "\r" is present.
Cause: find() returns idx[0]!=idx[1] ? idx : nullptr. Any partial run advances
idx[1] past idx[0], so a needle prefix at the buffer tail is reported as found.
A COMPLETE match always satisfies idx[1]-idx[0] == needle.size(); a partial one
does not. Guard suggestion — treat idx[1]-idx[0] != data.size() as not-found:
return (idx[1]-idx[0]) == (int) data.size() ? idx : nullptr;
Impact: silently corrupts any framed-protocol parser that splits a buffer on a
multi-char delimiter across reads (e.g. HTTP chunked size lines split on "\r\n"
when a TCP segment boundary lands mid-delimiter). General, not HTTP-specific.
string.h
find()reports a match when only a PREFIX of the needle occurs at theend of the buffer.
Repro:
string_t("4\r").find("\r\n")returns a non-null ptr [1,2] — a match for"\r\n" even though only "\r" is present.
Cause: find() returns
idx[0]!=idx[1] ? idx : nullptr. Any partial run advancesidx[1] past idx[0], so a needle prefix at the buffer tail is reported as found.
A COMPLETE match always satisfies
idx[1]-idx[0] == needle.size(); a partial onedoes not. Guard suggestion — treat
idx[1]-idx[0] != data.size()as not-found:Impact: silently corrupts any framed-protocol parser that splits a buffer on a
multi-char delimiter across reads (e.g. HTTP chunked size lines split on "\r\n"
when a TCP segment boundary lands mid-delimiter). General, not HTTP-specific.