http2: return error on OOM in push headers

Reported-by: M42kL33 on hackerone
Bug: https://hackerone.com/reports/3636044
Closes #21171
This commit is contained in:
Daniel Stenberg 2026-03-30 08:49:31 +02:00
parent 2f93a0e6bb
commit 9b36748938
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2

View file

@ -1488,8 +1488,11 @@ static int on_header(nghttp2_session *session, const nghttp2_frame *frame,
stream->push_headers = headp;
}
h = curl_maprintf("%s:%s", name, value);
if(h)
stream->push_headers[stream->push_headers_used++] = h;
if(!h) {
free_push_headers(stream);
return NGHTTP2_ERR_CALLBACK_FAILURE;
}
stream->push_headers[stream->push_headers_used++] = h;
return 0;
}