romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 13:03:35 +03:00
Code Issues Projects Releases Packages Wiki Activity

http: reject spurious CR bytes in headers

Browse source 
Verified by test 2105

Closes #21882
This commit is contained in:
Daniel Stenberg 2026-06-06 17:27:52 +02:00
parent 3b9f0972e2
commit c3c2cfb65d
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 58 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
lib/http.c
View file

@ -3818,6 +3818,14 @@ static CURLcode verify_header(struct Curl_easy *data,
failf(data, "Nul byte in header");
return CURLE_WEIRD_SERVER_REPLY;
}
if(hdlen > 2) {
ptr = memchr(hd, '\r', hdlen - 2);
if(ptr) {
/* CR may only precede the LF, nothing else */
failf(data, "Carriage return found in header");
return CURLE_WEIRD_SERVER_REPLY;
}
}
if(k->headerline < 2)
/* the first "header" is the status-line and it has no colon */
return CURLE_OK;