http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer dereference) by returning a crafted response that lacks a space character.
cpe:2.3:a:exiv2:exiv2:*:*:*:*:*:*:*:*
4BFA28DF-4BFE-4CA7-A2F7-F471F91B856E
0.27.1
OR
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
97A4B8DF-58DA-4AB6-A1F9-331B36409BA3
OR
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
07B237A9-69A3-4A9C-9DA0-4E06BD37AE73
OR
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
07C312A0-CD2C-4B9C-B064-6409B25C278F
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
CD783B0C-9246-47D9-A937-6144FE8BFF0F
OR
There is a null pointer deference bug at [http.cpp:364](https://github.com/Exiv2/exiv2/blob/55dfdb9ab007d6e6d1d06240048690eaac23b305/src/http.cpp#L364). If the http server sends back a reply that does not contain a space character, then `strchr` will return `NULL`, leading to a null pointer dereference in `atoi`.

To reproduce the bug (tested on master: [55dfdb9](https://github.com/Exiv2/exiv2/commit/55dfdb9ab007d6e6d1d06240048690eaac23b305)) open two terminals. In the first terminal, start a fake webserver using [response1.txt](https://github.com/Exiv2/exiv2/files/3113957/response1.txt):

```
cat response1.txt | sudo nc -l -p 80
```

In the second terminal, try to connect to the fake webserver:

```
exiv2 http://127.0.0.1/test.jpg
```

There are several other calls to `strcat` and `strstr` in the same [block of code](https://github.com/Exiv2/exiv2/blob/55dfdb9ab007d6e6d1d06240048690eaac23b305/src/http.cpp#L339-L396). I have not written PoCs for them, but the calls to `strchr` on lines [351](https://github.com/Exiv2/exiv2/blob/55dfdb9ab007d6e6d1d06240048690eaac23b305/src/http.cpp#L351) and [362](https://github.com/Exiv2/exiv2/blob/55dfdb9ab007d6e6d1d06240048690eaac23b305/src/http.cpp#L362) also look vulnerable to me. 
null pointer dereference in http.cpp
This is a GitHub Issue
repo:exiv2
owner:Exiv2
Title : null pointer dereference in http.cpp
Issue date:

--- start body ---
There is a null pointer deference bug at [http.cpp:364](https://github.com/Exiv2/exiv2/blob/55dfdb9ab007d6e6d1d06240048690eaac23b305/src/http.cpp#L364). If the http server sends back a reply that does not contain a space character, then `strchr` will return `NULL`, leading to a null pointer dereference in `atoi`.

To reproduce the bug (tested on master: [55dfdb9](https://github.com/Exiv2/exiv2/commit/55dfdb9ab007d6e6d1d06240048690eaac23b305)) open two terminals. In the first terminal, start a fake webserver using [response1.txt](https://github.com/Exiv2/exiv2/files/3113957/response1.txt):

```
cat response1.txt | sudo nc -l -p 80
```

In the second terminal, try to connect to the fake webserver:

```
exiv2 http://127.0.0.1/test.jpg
```

There are several other calls to `strcat` and `strstr` in the same [block of code](https://github.com/Exiv2/exiv2/blob/55dfdb9ab007d6e6d1d06240048690eaac23b305/src/http.cpp#L339-L396). I have not written PoCs for them, but the calls to `strchr` on lines [351](https://github.com/Exiv2/exiv2/blob/55dfdb9ab007d6e6d1d06240048690eaac23b305/src/http.cpp#L351) and [362](https://github.com/Exiv2/exiv2/blob/55dfdb9ab007d6e6d1d06240048690eaac23b305/src/http.cpp#L362) also look vulnerable to me. 
--- end body ---

comments :
--- start comments ---

--- end comments ---