romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-22 07:37:16 +03:00
Code Issues Projects Releases Packages Wiki Activity

http: avoid length underflow in Curl_compareheader

Browse source 
Closes #22338
This commit is contained in:
Graham Campbell 2026-07-16 16:30:19 +01:00 • committed by Daniel Stenberg
parent b41c28e70a
commit f0f84d1251
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 10 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
lib/http.c
View file

@ -1440,6 +1440,10 @@ bool Curl_compareheader(const char *headerline, /* line to check */
do
curlx_str_passblanks(&p);
while(!curlx_str_single(&p, ','));
/* trailing blanks may move the parsing point past the value end,
then there is nothing left to match */
if((size_t)(p - o) > len)
break;
len -= (p - o);
}
}

2
tests/data/test1625
View file

@ -19,7 +19,7 @@ Curl_compareheader unit test
<verify>
<stdout mode="text">
31 invokes
33 invokes
</stdout>
</verify>
</testcase>

5
tests/unit/unit1625.c
View file

@ -102,6 +102,11 @@ static CURLcode test_unit1625(const char *arg)
{ "Encoding: super-nice", "Encoding:", "super-nice", TRUE },
/* hyphenated second token */
{ "Encoding: extra-good, super-nice", "Encoding:", "super-nice", TRUE },
/* trailing blanks after the last comma */
{ "Encoding: gzipped, ", "Encoding:", "gzip", FALSE },
/* the scan must not cross into a second line */
{ "Encoding: gzipped, \r\nEncoding: gzip, chunked", "Encoding:",
"chunked", FALSE },
};
for(i = 0; i < CURL_ARRAYSIZE(list); i++) {