romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-01 19:10:29 +03:00
Code Issues Projects Releases Packages Wiki Activity

http: return error when receiving too large header set

Browse source 
To avoid abuse. The limit is set to 300 KB for the accumulated size of
all received HTTP headers for a single response. Incomplete research
suggests that Chrome uses a 256-300 KB limit, while Firefox allows up to
1MB.

Closes #11582
This commit is contained in:
Daniel Stenberg 2023-08-02 23:34:48 +02:00
parent 944e219f10
commit 3ee79c1674
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
6 changed files with 60 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

12
lib/c-hyper.c
View file

@ -182,8 +182,11 @@ static int hyper_each_header(void *userdata,
}
}
data->info.header_size += (curl_off_t)len;
data->req.headerbytecount += (curl_off_t)len;
result = Curl_bump_headersize(data, len, FALSE);
if(result) {
data->state.hresult = result;
return HYPER_ITER_BREAK;
}
return HYPER_ITER_CONTINUE;
}
@ -313,9 +316,8 @@ static CURLcode status_line(struct Curl_easy *data,
if(result)
return result;
}
data->info.header_size += (curl_off_t)len;
data->req.headerbytecount += (curl_off_t)len;
return CURLE_OK;
result = Curl_bump_headersize(data, len, FALSE);
return result;
}
/*