socks: fix expected length of SOCKS5 reply

[Cherish98]

Commit 4a4b63d forgot to initialize the expected SOCKS5 reply length, and neither did it set it to the correct value of 10 when the reply ATYP is X'01'. This results in erroneously expecting more bytes when the request length is greater than the reply length (e.g., when remotely resolving the hostname).

[Cherish98]

Alternatively, set the length when socksreq[3] == 1 here:

curl/lib/socks.c

Lines 928 to 937 in a00668d

	/* Calculate real packet size */
	if(socksreq[3] == 3) {
	/* domain name */
	int addrlen = (int) socksreq[4];
	len = 5 + addrlen + 2;
	}
	else if(socksreq[3] == 4) {
	/* IPv6 */
	len = 4 + 16 + 2;
	}

Otherwise, len is left with the length of the SOCKS5 request. When the request ATYP is domain name and reply ATYP is V4 address, it will wait for more bytes here:

curl/lib/socks.c

Lines 944 to 952 in a00668d

	if(len > 10) {
	sx->outstanding = len - 10; /* get the rest */
	sx->outp = &socksreq[10];
	sxstate(conn, CONNECT_REQ_READ_MORE);
	}
	else {
	sxstate(conn, CONNECT_DONE);
	break;
	}

[bagder]

Alternatively, set the length when socksreq[3] == 1 here:

I think would prefer that for greater redability, and then do a final elseand return error if that byte is not one of the known values instead of just silently continuing...

[Cherish98]

Alternatively, set the length when socksreq[3] == 1 here:

I think would prefer that for greater redability, and then do a final elseand return error if that byte is not one of the known values instead of just silently continuing...

On a second thought, I agree that would be the correct fix. Because the original patch in the pull request set len across sock state boundaries, and thus wrong (zero) values can sometimes be used here.

[bagder]

Yes, very good point!

[Cherish98]

I have drafted a v2 patch in af1a5f5.

[bagder]

Thanks!