romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-10 04:27:21 +03:00
Code Issues Projects Releases Packages Wiki Activity

doh: stricter HTTPS RNAME parsing

Browse source 
If any sublabel is longer than 63 octets, abort. This then also catches
compression attempts.

Verified in test 1658

Reported-by: netspacer.research
Closes #22124
This commit is contained in:
Daniel Stenberg 2026-06-22 09:10:15 +02:00
parent e8e3af2abb
commit ab779d4e4a
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 31 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/httpsrr.h
View file

@ -31,7 +31,7 @@
#ifdef USE_HTTPSRR
#define CURL_MAXLEN_host_name 253
#define CURL_MAXLEN_HOST_NAME 253
#define MAX_HTTPSRR_ALPNS 4
struct Curl_easy;