romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-28 16:53:11 +03:00
Code Issues Projects Releases Packages Wiki Activity

headers: enforce a max number of response header to accept

Browse source 
The limit is 5000 headers in a single transfer. To avoid problems caused
by mistakes or malice.

Add test 747 to verify

Reported-by: wolfsage on hackerone

Closes #17281
This commit is contained in:
Daniel Stenberg 2025-05-08 00:21:26 +02:00
parent d689bd915e
commit 40ef77b6da
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
5 changed files with 67 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
lib/headers.c
View file

@ -313,6 +313,11 @@ CURLcode Curl_headers_push(struct Curl_easy *data, const char *header,
return CURLE_WEIRD_SERVER_REPLY;
}
}
if(Curl_llist_count(&data->state.httphdrs) >= MAX_HTTP_RESP_HEADER_COUNT) {
failf(data, "Too many response headers, %d is max",
MAX_HTTP_RESP_HEADER_COUNT);
return CURLE_TOO_LARGE;
}
hs = calloc(1, sizeof(*hs) + hlen);
if(!hs)

4
lib/http.h
View file

@ -174,6 +174,10 @@ CURLcode Curl_http_follow(struct Curl_easy *data, const char *newurl,
version. This count includes CONNECT response headers. */
#define MAX_HTTP_RESP_HEADER_SIZE (300*1024)
/* MAX_HTTP_RESP_HEADER_COUNT is the maximum number of response headers that
libcurl allows for a single HTTP response, including CONNECT and
redirects. */
#define MAX_HTTP_RESP_HEADER_COUNT 5000
#endif /* CURL_DISABLE_HTTP */