romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-26 22:34:45 +03:00
Code Issues Projects Releases Packages Wiki Activity

http: fix response code parser to avoid integer overflow

Browse source 
test 1429 and 1433 were updated to work with the stricter HTTP status line
parser.

Closes #1714
Reported-by: Brian Carpenter
This commit is contained in:
Daniel Stenberg 2017-07-31 17:11:18 +02:00
parent 512f8c774a
commit 909283ae5a
3 changed files with 16 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

15
lib/http.c
View file

@ -3322,19 +3322,22 @@ CURLcode Curl_http_readwrite_headers(struct Curl_easy *data,
* says. We try to allow any number here, but we cannot make
* guarantees on future behaviors since it isn't within the protocol.
*/
char separator;
nc = sscanf(HEADER1,
" HTTP/%d.%d %d",
" HTTP/%1d.%1d%c%3d",
&httpversion_major,
&conn->httpversion,
&separator,
&k->httpcode);
if(nc == 1 && httpversion_major == 2 &&
1 == sscanf(HEADER1, " HTTP/2 %d", &k->httpcode)) {
conn->httpversion = 0;
nc = 3;
nc = 4;
separator = ' ';
}
if(nc==3) {
if((nc==4) && (' ' == separator)) {
conn->httpversion += 10 * httpversion_major;
if(k->upgr101 == UPGR101_RECEIVED) {
@ -3343,7 +3346,7 @@ CURLcode Curl_http_readwrite_headers(struct Curl_easy *data,
infof(data, "Lying server, not serving HTTP/2\n");
}
}
else {
else if(!nc) {
/* this is the real world, not a Nirvana
NCSA 1.5.x returns this crap when asked for HTTP/1.1
*/
@ -3361,6 +3364,10 @@ CURLcode Curl_http_readwrite_headers(struct Curl_easy *data,
}
}
}
else {
failf(data, "Unsupported HTTP version in response\n");
return CURLE_UNSUPPORTED_PROTOCOL;
}
}
else if(conn->handler->protocol & CURLPROTO_RTSP) {
nc = sscanf(HEADER1,