Server-Timing

third_party/WebKit/Source/platform/network/HTTPParsers.cpp

Index: third_party/WebKit/Source/platform/network/HTTPParsers.cpp
diff --git a/third_party/WebKit/Source/platform/network/HTTPParsers.cpp b/third_party/WebKit/Source/platform/network/HTTPParsers.cpp
index 9721bf6c1c4a765922aa8b02368d5166abb222fb..ee06f9598cd792fb62ba6e8df920bf9610cc8a7e 100644
--- a/third_party/WebKit/Source/platform/network/HTTPParsers.cpp
+++ b/third_party/WebKit/Source/platform/network/HTTPParsers.cpp
@@ -849,4 +849,67 @@ bool ParseContentRangeHeaderFor206(const String& content_range,
       last_byte_position, instance_length);
 }
 
+template <typename CharType>
+inline bool IsNotServerTimingHeaderDelimiter(CharType c) {
+  return c != '=' && c != ';' && c != ',';
+}
+
+const LChar* ParseServerTimingToken(const LChar* begin,
+                                    const LChar* end,
+                                    String& result) {
+  const LChar* position = begin;
+  skipWhile<LChar, IsNotServerTimingHeaderDelimiter>(position, end);
+  result = String(begin, position - begin).StripWhiteSpace();
+  return position;
+}
+
+String CheckDoubleQuotedString(const String& value) {
+  if (value.length() < 2 || value[0] != '"' ||
+      value[value.length() - 1] != '"') {
+    return value;
+  }
+
+  StringBuilder out;
+  unsigned pos = 1;                   // Begin after the opening DQUOTE.
+  unsigned len = value.length() - 1;  // End before the closing DQUOTE.
+
+  // Skip past backslashes, but include everything else.
+  while (pos < len) {
+    if (value[pos] == '\\')
+      pos++;
+    if (pos < len)
+      out.Append(value[pos++]);
+  }
+
+  return out.ToString();
+}
+
+std::unique_ptr<ServerTimingHeaderVector> ParseServerTimingHeader(
+    const String& headerValue) {
+  std::unique_ptr<ServerTimingHeaderVector> headers =
+      WTF::MakeUnique<ServerTimingHeaderVector>();
+
+  if (!headerValue.IsNull()) {
+    DCHECK(headerValue.Is8Bit());
+
+    const LChar* position = headerValue.Characters8();
+    const LChar* end = position + headerValue.length();
+    while (position < end) {
+      String metric, value, description = "";
+      position = ParseServerTimingToken(position, end, metric);
+      if (*position == '=') {

[Yoav Weiss, 2017/05/03 08:20:04]

Seems like your ASAN issues are originating here. I suspect that when skipWhile
finds no delimiter (e.g. "blablabla" as an input string), ParseServerTimingToken
will return a `position` equivalent to `end`. `end` is beyond the defined
buffer, so reading from it is a buffer overflow. You should add protections that
break out of the loop when `end` is reached in the middle of it.  

+        position = ParseServerTimingToken(position + 1, end, value);
+      }
+      if (*position == ';') {
+        position = ParseServerTimingToken(position + 1, end, description);
+      }
+      position++;
+
+      headers->push_back(WTF::MakeUnique<ServerTimingHeader>(
+          metric, value.ToDouble(), CheckDoubleQuotedString(description)));
+    }
+  }
+  return headers;
+}
+
 }  // namespace blink