romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-27 05:58:06 +03:00
Code Issues Projects Releases Packages Wiki Activity

http: return error on colon-less HTTP headers

Browse source 
It's a protocol violation and accepting them leads to no good.

Add test case 398 to verify

Closes #8610
This commit is contained in:
Daniel Stenberg 2022-03-18 22:54:59 +01:00
parent 33fe8251cb
commit dcdf2e8a36
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 91 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

32
lib/http.c
View file

@ -3775,6 +3775,29 @@ CURLcode Curl_http_size(struct Curl_easy *data)
return CURLE_OK;
}
static CURLcode verify_header(struct Curl_easy *data)
{
struct SingleRequest *k = &data->req;
const char *header = Curl_dyn_ptr(&data->state.headerb);
size_t hlen = Curl_dyn_len(&data->state.headerb);
char *ptr = memchr(header, 0x00, hlen);
if(ptr) {
/* this is bad, bail out */
failf(data, "Nul byte in header");
return CURLE_WEIRD_SERVER_REPLY;
}
if(k->headerline < 2)
/* the first "header" is the status-line and it has no colon */
return CURLE_OK;
ptr = memchr(header, ':', hlen);
if(!ptr) {
/* this is bad, bail out */
failf(data, "Header without semicolon");
return CURLE_WEIRD_SERVER_REPLY;
}
return CURLE_OK;
}
/*
* Read any HTTP header lines from the server and pass them to the client app.
*/
@ -4283,12 +4306,9 @@ CURLcode Curl_http_readwrite_headers(struct Curl_easy *data,
}
}
end_ptr = memchr(headp, 0x00, Curl_dyn_len(&data->state.headerb));
if(end_ptr) {
/* this is bad, bail out */
failf(data, "Nul byte in header");
return CURLE_WEIRD_SERVER_REPLY;
}
result = verify_header(data);
if(result)
return result;
result = Curl_http_header(data, conn, headp);
if(result)