romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-26 01:53:31 +03:00
Code Issues Projects Releases Packages Wiki Activity

doh: stricter HTTPS RNAME parsing

Browse source 
If any sublabel is longer than 63 octets, abort. This then also catches
compression attempts.

Verified in test 1658

Reported-by: netspacer.research
Closes #22124
This commit is contained in:
Daniel Stenberg 2026-06-22 09:10:15 +02:00
parent e8e3af2abb
commit ab779d4e4a
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 31 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

21
tests/unit/unit1658.c
View file

@ -493,7 +493,26 @@ static CURLcode test_unit1658(const char *arg)
"ech:fe80dabbc1ff7eb38a22123456789123|"
"ipv6:fe80:dabb:c1ff:fea3:8a22:1234:5678:9123|"
"ipv6:ee80:dabb:c1ff:fea3:8a22:1234:5678:9125|"
}
},
{
"rname too long label",
(const unsigned char *)"\x00\x00" /* 16-bit prio */
"\x40"
"0123456789012345678901234567890123456789012345678901234567890123"
"\x04some\x00", /* RNAME */
73,
"r:27|",
},
{
"rname long label",
(const unsigned char *)"\x00\x00" /* 16-bit prio */
"\x3f"
"012345678901234567890123456789012345678901234567890123456789012"
"\x04some\x00", /* RNAME */
72,
"r:0|p:0|"
"012345678901234567890123456789012345678901234567890123456789012.some.|",
},
};
CURLcode result = CURLE_OUT_OF_MEMORY;