romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 12:03:34 +03:00
Code Issues Projects Releases Packages Wiki Activity

doh: stricter HTTPS RNAME parsing

Browse source 
If any sublabel is longer than 63 octets, abort. This then also catches
compression attempts.

Verified in test 1658

Reported-by: netspacer.research
Closes #22124
This commit is contained in:
Daniel Stenberg 2026-06-22 09:10:15 +02:00
parent e8e3af2abb
commit ab779d4e4a
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 31 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

11
lib/doh.c
View file

@ -1092,10 +1092,14 @@ static CURLcode doh_decode_rdata_name(const unsigned char **buf,
DEBUGASSERT(buf && remaining && dnsname);
if(!buf || !remaining || !dnsname || !*remaining)
return CURLE_OUT_OF_MEMORY;
curlx_dyn_init(&thename, CURL_MAXLEN_host_name);
curlx_dyn_init(&thename, CURL_MAXLEN_HOST_NAME);
rem = *remaining;
cp = *buf;
clen = *cp++;
/* RFC 9460 says it must be uncompressed */
if(clen > 63)
return CURLE_WEIRD_SERVER_REPLY;
if(clen == 0) {
/* special case - return "." as name */
if(curlx_dyn_addn(&thename, ".", 1))
@ -1117,6 +1121,11 @@ static CURLcode doh_decode_rdata_name(const unsigned char **buf,
return CURLE_OUT_OF_MEMORY;
}
clen = *cp++;
if(clen > 63) {
/* invalid format */
curlx_dyn_free(&thename);
return CURLE_WEIRD_SERVER_REPLY;
}
}
*buf = cp;
*remaining = rem - 1;

2
lib/httpsrr.h
View file

@ -31,7 +31,7 @@
#ifdef USE_HTTPSRR
#define CURL_MAXLEN_host_name 253
#define CURL_MAXLEN_HOST_NAME 253
#define MAX_HTTPSRR_ALPNS 4
struct Curl_easy;