romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-04 13:16:35 +03:00
Code Issues Projects Releases Packages Wiki Activity

chunked: reject invalid bytes in trailer

Browse source 
Trailers are delivered to the application as headers via
CLIENTWRITE_TRAILER, but unlike regular response headers they skipped
the verify_header() checks, so a server could smuggle a nul byte (or
stray CR) into a header reaching CURLOPT_HEADERFUNCTION and
curl_easy_header().

Run each assembled trailer line through Curl_verify_header(), the same
validation used for normal headers.

Covered by the new test 2106.

Closes #21896
This commit is contained in:
alhudz 2026-06-08 10:37:34 +05:30 • committed by Daniel Stenberg
parent d69bfad3fa
commit 7de0a7e71a
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
5 changed files with 75 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

6
lib/http.c
View file

@ -3808,8 +3808,8 @@ static CURLcode http_size(struct Curl_easy *data)
return CURLE_OK;
}
static CURLcode verify_header(struct Curl_easy *data,
const char *hd, size_t hdlen)
CURLcode Curl_verify_header(struct Curl_easy *data,
const char *hd, size_t hdlen)
{
struct SingleRequest *k = &data->req;
const char *ptr = memchr(hd, 0x00, hdlen);
@ -4359,7 +4359,7 @@ static CURLcode http_rw_hd(struct Curl_easy *data,
}
}
result = verify_header(data, hd, hdlen);
result = Curl_verify_header(data, hd, hdlen);
if(result)
return result;

5
lib/http.h
View file

@ -106,6 +106,11 @@ CURLcode Curl_http_write_resp_hd(struct Curl_easy *data,
const char *hd, size_t hdlen,
bool is_eos);
/* check a received header line for forbidden bytes/format, the same checks
applied to regular response headers */
CURLcode Curl_verify_header(struct Curl_easy *data,
const char *hd, size_t hdlen);
/* These functions are in http.c */
CURLcode Curl_http_input_auth(struct Curl_easy *data, bool proxy,
const char *auth);

14
lib/http_chunks.c
View file

@ -27,6 +27,7 @@
#include "urldata.h" /* it includes http_chunks.h */
#include "curl_trc.h"
#include "http.h" /* for Curl_verify_header */
#include "sendf.h" /* for the client write stuff */
#include "curlx/dynbuf.h"
#include "multiif.h"
@ -247,6 +248,7 @@ static CURLcode httpchunk_readwrite(struct Curl_easy *data,
there was no trailer and we move on */
if(tr) {
size_t trlen;
result = curlx_dyn_addn(&ch->trailer, STRCONST("\x0d\x0a"));
if(result) {
ch->state = CHUNK_FAILED;
@ -254,8 +256,18 @@ static CURLcode httpchunk_readwrite(struct Curl_easy *data,
return result;
}
tr = curlx_dyn_ptr(&ch->trailer);
trlen = curlx_dyn_len(&ch->trailer);
/* a trailer is delivered to the client as a header, so it must pass
the same checks as a regular response header */
result = Curl_verify_header(data, tr, trlen);
if(result) {
ch->state = CHUNK_FAILED;
ch->last_code = CHUNKE_BAD_CHUNK;
return result;
}
if(!data->set.http_te_skip) {
size_t trlen = curlx_dyn_len(&ch->trailer);
if(cw_next)
result = Curl_cwriter_write(data, cw_next,
CLIENTWRITE_HEADER |