romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-26 06:53:32 +03:00
Code Issues Projects Releases Packages Wiki Activity

http: return error when receiving too large header set

Browse source 
To avoid abuse. The limit is set to 300 KB for the accumulated size of
all received HTTP headers for a single response. Incomplete research
suggests that Chrome uses a 256-300 KB limit, while Firefox allows up to
1MB.

Closes #11582
This commit is contained in:
Daniel Stenberg 2023-08-02 23:34:48 +02:00
parent 944e219f10
commit 3ee79c1674
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
6 changed files with 60 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

9
lib/http.h
View file

@ -64,6 +64,10 @@ extern const struct Curl_handler Curl_handler_wss;
struct dynhds;
CURLcode Curl_bump_headersize(struct Curl_easy *data,
size_t delta,
bool connect_only);
/* Header specific functions */
bool Curl_compareheader(const char *headerline, /* line to check */
const char *header, /* header keyword _with_ colon */
@ -183,6 +187,11 @@ CURLcode Curl_http_auth_act(struct Curl_easy *data);
#define EXPECT_100_THRESHOLD (1024*1024)
#endif
/* MAX_HTTP_RESP_HEADER_SIZE is the maximum size of all response headers
combined that libcurl allows for a single HTTP response, any HTTP
version. This count includes CONNECT response headers. */
#define MAX_HTTP_RESP_HEADER_SIZE (300*1024)
#endif /* CURL_DISABLE_HTTP */
/****************************************************************************