romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 20:43:32 +03:00
Code Issues Projects Releases Packages Wiki Activity

http: reject HTTP response codes < 100

Browse source 
... which then also includes negative ones as test 1430 uses.

This makes native + hyper backend act identically on this and therefore
test 1430 can now be enabled when building with hyper. Adjust test 1431
as well.

Closes #7909
This commit is contained in:
Daniel Stenberg 2021-10-26 17:47:14 +02:00
parent c40914dbdb
commit c67a32fc56
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
4 changed files with 16 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

8
lib/http.c
View file

@ -4240,8 +4240,12 @@ CURLcode Curl_http_readwrite_headers(struct Curl_easy *data,
/* There can only be a 4th response code digit stored in 'digit4' if
all the other fields were parsed and stored first, so nc is 5 when
digit4 a digit */
else if(ISDIGIT(digit4)) {
digit4 a digit.
The sscanf() line above will also allow zero-prefixed and negative
numbers, so we check for that too here.
*/
else if(ISDIGIT(digit4) || (k->httpcode < 100)) {
failf(data, "Unsupported response code in HTTP response");
return CURLE_UNSUPPORTED_PROTOCOL;
}