romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-25 02:37:18 +03:00
Code Issues Projects Releases Packages Wiki Activity

altsvc: reject bad port numbers

Browse source 
The existing code tried but did not properly reject alternative services
using negative or too large port numbers.

With this fix, the logic now also flushes the old entries immediately
before adding a new one, making a following header with an illegal entry
not flush the already stored entry.

Report from the ongoing source code audit by Trail of Bits.

Adjusted test 356 to verify.

Closes #9607
This commit is contained in:
Daniel Stenberg 2022-09-27 17:20:23 +02:00
parent eb33ccd533
commit ac612dfeee
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 16 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/data/test356
View file

@ -16,7 +16,9 @@ Content-Length: 6
Connection: close
Content-Type: text/html
Funny-head: yesyes
Alt-Svc: h1="nowhere.foo:-1"
Alt-Svc: h1="nowhere.foo:81", un-kno22!wn=":82"
Alt-Svc: h1="nowhere.foo:70000"
-foo-
</data>