romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 06:33:32 +03:00
Code Issues Projects Releases Packages Wiki Activity

chunked: reject invalid bytes in trailer

Browse source 
Trailers are delivered to the application as headers via
CLIENTWRITE_TRAILER, but unlike regular response headers they skipped
the verify_header() checks, so a server could smuggle a nul byte (or
stray CR) into a header reaching CURLOPT_HEADERFUNCTION and
curl_easy_header().

Run each assembled trailer line through Curl_verify_header(), the same
validation used for normal headers.

Covered by the new test 2106.

Closes #21896
This commit is contained in:
alhudz 2026-06-08 10:37:34 +05:30 • committed by Daniel Stenberg
parent d69bfad3fa
commit 7de0a7e71a
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
5 changed files with 75 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

6
lib/http.c
View file

@ -3808,8 +3808,8 @@ static CURLcode http_size(struct Curl_easy *data)
return CURLE_OK;
}
static CURLcode verify_header(struct Curl_easy *data,
const char *hd, size_t hdlen)
CURLcode Curl_verify_header(struct Curl_easy *data,
const char *hd, size_t hdlen)
{
struct SingleRequest *k = &data->req;
const char *ptr = memchr(hd, 0x00, hdlen);
@ -4359,7 +4359,7 @@ static CURLcode http_rw_hd(struct Curl_easy *data,
}
}
result = verify_header(data, hd, hdlen);
result = Curl_verify_header(data, hd, hdlen);
if(result)
return result;