romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 14:53:34 +03:00
Code Issues Projects Releases Packages Wiki Activity

chunked: reject invalid bytes in trailer

Browse source 
Trailers are delivered to the application as headers via
CLIENTWRITE_TRAILER, but unlike regular response headers they skipped
the verify_header() checks, so a server could smuggle a nul byte (or
stray CR) into a header reaching CURLOPT_HEADERFUNCTION and
curl_easy_header().

Run each assembled trailer line through Curl_verify_header(), the same
validation used for normal headers.

Covered by the new test 2106.

Closes #21896
This commit is contained in:
alhudz 2026-06-08 10:37:34 +05:30 • committed by Daniel Stenberg
parent d69bfad3fa
commit 7de0a7e71a
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
5 changed files with 75 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/data/Makefile.am
View file

@ -253,7 +253,7 @@ test2064 test2065 test2066 test2067 test2068 test2069 test2070 test2071 \
test2072 test2073 test2074 test2075 test2076 test2077 test2078 test2079 \
test2080 test2081 test2082 test2083 test2084 test2085 test2086 test2087 \
test2088 test2089 test2090 test2091 test2092 \
test2100 test2101 test2102 test2103 test2104 test2105 \
test2100 test2101 test2102 test2103 test2104 test2105 test2106 \
\
test2200 test2201 test2202 test2203 test2204 test2205 test2206 test2207 \
\