romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-05 16:16:14 +03:00
Code Issues Projects Releases Packages Wiki Activity

content_encoding: fix non-last chunked rejection

Browse source 
Even when two 'chunked' are listed and neither is the last encoding the
transfer is rejected.

Verified by test 1722 and 1723

Reported-by: violet12331 on hackerone
Closes #21966
This commit is contained in:
Daniel Stenberg 2026-06-11 10:59:05 +02:00
parent b7c9229cc6
commit 2b336e6b73
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
4 changed files with 146 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

47
lib/content_encoding.c
View file

@ -789,17 +789,6 @@ CURLcode Curl_build_unencoding_stack(struct Curl_easy *data,
}
cwt = find_unencode_writer(name, namelen, phase);
if(cwt && is_chunked && Curl_cwriter_get_by_type(data, cwt)) {
/* A 'chunked' transfer encoding has already been added.
* Ignore duplicates. See #13451.
* Also RFC 9112, ch. 6.1:
* "A sender MUST NOT apply the chunked transfer coding more than
* once to a message body."
*/
CURL_TRC_WRITE(data, "ignoring duplicate 'chunked' decoder");
return CURLE_OK;
}
if(is_transfer && !is_chunked &&
Curl_cwriter_get_by_name(data, "chunked")) {
/* RFC 9112, ch. 6.1:
@ -814,21 +803,31 @@ CURLcode Curl_build_unencoding_stack(struct Curl_easy *data,
"Transfer-Encoding");
return CURLE_BAD_CONTENT_ENCODING;
}
if(cwt && is_chunked && Curl_cwriter_get_by_type(data, cwt)) {
/* A 'chunked' transfer encoding has already been added.
* Ignore duplicates. See #13451.
* Also RFC 9112, ch. 6.1:
* "A sender MUST NOT apply the chunked transfer coding more than
* once to a message body."
*/
CURL_TRC_WRITE(data, "ignoring duplicate 'chunked' decoder");
}
else {
if(!cwt)
cwt = &error_writer; /* Defer error at use. */
if(!cwt)
cwt = &error_writer; /* Defer error at use. */
result = Curl_cwriter_create(&writer, data, cwt, phase);
CURL_TRC_WRITE(data, "added %s decoder %s -> %d",
is_transfer ? "transfer" : "content", cwt->name,
(int)result);
if(result)
return result;
result = Curl_cwriter_create(&writer, data, cwt, phase);
CURL_TRC_WRITE(data, "added %s decoder %s -> %d",
is_transfer ? "transfer" : "content", cwt->name,
(int)result);
if(result)
return result;
result = Curl_cwriter_add(data, writer);
if(result) {
Curl_cwriter_free(data, writer);
return result;
result = Curl_cwriter_add(data, writer);
if(result) {
Curl_cwriter_free(data, writer);
return result;
}
}
if(is_chunked)
has_chunked = TRUE;