romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 04:23:36 +03:00
Code Issues Projects Releases Packages Wiki Activity

chunked: reject invalid bytes in trailer

Browse source 
Trailers are delivered to the application as headers via
CLIENTWRITE_TRAILER, but unlike regular response headers they skipped
the verify_header() checks, so a server could smuggle a nul byte (or
stray CR) into a header reaching CURLOPT_HEADERFUNCTION and
curl_easy_header().

Run each assembled trailer line through Curl_verify_header(), the same
validation used for normal headers.

Covered by the new test 2106.

Closes #21896
This commit is contained in:
alhudz 2026-06-08 10:37:34 +05:30 • committed by Daniel Stenberg
parent d69bfad3fa
commit 7de0a7e71a
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
5 changed files with 75 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

5
lib/http.h
View file

@ -106,6 +106,11 @@ CURLcode Curl_http_write_resp_hd(struct Curl_easy *data,
const char *hd, size_t hdlen,
bool is_eos);
/* check a received header line for forbidden bytes/format, the same checks
applied to regular response headers */
CURLcode Curl_verify_header(struct Curl_easy *data,
const char *hd, size_t hdlen);
/* These functions are in http.c */
CURLcode Curl_http_input_auth(struct Curl_easy *data, bool proxy,
const char *auth);