cybersecurity · intermediate · ~15 min · safe pentest lab
Practise defensive parsing of a real protocol from sample text.
Parse an HTTP request line into its three fields — network code is mostly parsing, and bounds-checking each field as you copy is what prevents buffer-overflow CVEs.
Implement int parse_request_line(const char *line, http_req_t *out) that parses METHOD PATH VERSION\r\n into the struct:
typedef struct { char method[8]; char path[256]; char version[16]; } http_req_t;
line: a NUL-terminated request line of the form METHOD PATH VERSION\r\n. The grader passes fixed strings.out: the struct to fill on success.Returns int: 0 on success (filling out), -1 on malformed input.
"GET /index.html HTTP/1.1\r\n" -> 0, method="GET", path="/index.html", version="HTTP/1.1"
"GET /\r\n" -> -1 (only two fields)
"REALLYLONGMETHOD / HTTP/1.1\r\n" -> -1 (method overflows)
\r\n. Reject (return -1) rather than truncate any field that would overflow.A NUL-terminated request line METHOD PATH VERSION\r\n and an output http_req_t pointer.
An int: 0 on success with out filled, -1 on malformed input.
Single-space separators; reject any field that would overflow its bounded buffer.
#include <stdio.h>
#include <string.h>
int parse_request_line(const char *line, http_req_t *out) {
/* TODO */
return -1;
}
Solve this exercise in the browser editor — compile and run against the test harness, no setup required.