romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-04 08:09:58 +03:00
Code Issues Projects Releases Packages Wiki Activity

lib: fix two curlx_strtoofft invokes

Browse source 
- cf-h1-proxy: check return code and return error if the parser fails

- http: make the Retry-After parser check for a date string first then
  number to avoid mis-parsing the begining of a date as a number

Closes #16548
This commit is contained in:
Daniel Stenberg 2025-03-03 22:40:43 +01:00
parent 9213e4e497
commit 18c6d5512f
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 17 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

7
lib/cf-h1-proxy.c
View file

@ -315,8 +315,11 @@ static CURLcode on_resp_header(struct Curl_cfilter *cf,
k->httpcode);
}
else {
(void)curlx_strtoofft(header + strlen("Content-Length:"),
NULL, 10, &ts->cl);
if(curlx_strtoofft(header + strlen("Content-Length:"),
NULL, 10, &ts->cl)) {
failf(data, "Unsupported Content-Length value");
return CURLE_WEIRD_SERVER_REPLY;
}
}
}
else if(Curl_compareheader(header,

20
lib/http.c
View file

@ -3228,18 +3228,22 @@ static CURLcode http_header(struct Curl_easy *data,
if(v) {
/* Retry-After = HTTP-date / delay-seconds */
curl_off_t retry_after = 0; /* zero for unknown or "now" */
/* Try it as a decimal number, if it works it is not a date */
(void)curlx_strtoofft(v, NULL, 10, &retry_after);
if(!retry_after) {
time_t date = Curl_getdate_capped(v);
time_t date;
Curl_str_passblanks(&v);
/* try it as a date first, because a date can otherwise start with and
get treated as a number */
date = Curl_getdate_capped(v);
if((time_t)-1 != date) {
time_t current = time(NULL);
if((time_t)-1 != date && date > current) {
if(date >= current)
/* convert date to number of seconds into the future */
retry_after = date - current;
}
}
if(retry_after < 0)
retry_after = 0;
else
/* Try it as a decimal number */
Curl_str_number(&v, &retry_after, CURL_OFF_T_MAX);
/* limit to 6 hours max. this is not documented so that it can be changed
in the future if necessary. */
if(retry_after > 21600)