Fix stack data disclosure when returning static files smaller than 16KiB

[mrozigor]

It could also cause to return partially incorrect file ending in
case of file not being rounded up to 16KiB.

Thanks to Gynvael Coldwind and hebi for discovering and preparing
report.

[luca-schlecker]

Is there a reason that the buffers vector is inside the loop?

[mrozigor]

It was already implemented like this. It looks like asio::write expects vector of buffers. Also it looks like asio::buffer doesn't own memory (https://think-async.com/Asio/asio-1.22.1/doc/asio/reference/buffer.html#asio.reference.buffer.buffer_invalidation), so we have to:

• send it buffers vector immediately with only one buffer and then use existing array to load next part of a file (current solution)

• copy memory from array (or maybe load data directly to asio::buffer) with use of (I guess) asio::buffer_copy (https://think-async.com/Asio/asio-1.22.1/doc/asio/reference/buffer_copy.html)

[luca-schlecker]

I see, the current solution works fine, no need to add extra copy-operations.

LGTM 👍

[mrozigor]

I'll leave it till tomorrow and then merge. Thanks!

[MichaelSB]

The vector with size 1 could be constructed outside the loop. And then the asio::buffer would be assigned to the first element in the vector inside the loop. Imo. No copy needed and we would save construction/destruction of a vector in a loop (probably alloc/dealloc)

[mrozigor]

Good point. I didn't want to change anything not connected directly with error, but maybe postponing it is a worse idea :P

[crow-clang-format]

--- include/crow/http_connection.h	(before formatting)
+++ include/crow/http_connection.h	(after formatting)
@@ -389,7 +389,7 @@
             if (res.file_info.statResult == 0)
             {
                 std::ifstream is(res.file_info.path.c_str(), std::ios::in | std::ios::binary);
-                std::vector<asio::const_buffer> buffers {1};
+                std::vector<asio::const_buffer> buffers{1};
                 char buf[16384];
                 is.read(buf, sizeof(buf));
                 while (is.gcount() > 0)