luo980/curl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

http: use per-request counter to check too large headers

Browse Source 
Not the counter that accumulates all headers over all redirects.

Follow-up to 3ee79c1674

Do a second check for 20 times the limit for the accumulated size for
all headers.

Fixes #11871
Reported-by: Joshix-1 on github
Closes #11872
This commit is contained in:
Daniel Stenberg 2023-09-16 23:54:44 +02:00
parent 68ee7f8b7e
commit 2cb0d346aa
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
2 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
lib/http.c
View File

@ -3970,18 +3970,23 @@ CURLcode Curl_bump_headersize(struct Curl_easy *data,
bool connect_only)
{
size_t bad = 0;
unsigned int max = MAX_HTTP_RESP_HEADER_SIZE;
if(delta < MAX_HTTP_RESP_HEADER_SIZE) {
data->info.header_size += (unsigned int)delta;
data->req.allheadercount += (unsigned int)delta;
if(!connect_only)
data->req.headerbytecount += (unsigned int)delta;
data->info.header_size += (unsigned int)delta;
if(data->info.header_size > MAX_HTTP_RESP_HEADER_SIZE)
if(data->req.allheadercount > max)
bad = data->req.allheadercount;
else if(data->info.header_size > (max * 20)) {
bad = data->info.header_size;
max *= 20;
}
}
else
bad = data->info.header_size + delta;
bad = data->req.allheadercount + delta;
if(bad) {
failf(data, "Too large response headers: %zu > %u",
bad, MAX_HTTP_RESP_HEADER_SIZE);
failf(data, "Too large response headers: %zu > %u", bad, max);
return CURLE_RECV_ERROR;
}
return CURLE_OK;

4
lib/urldata.h
View File

@ -640,7 +640,9 @@ struct SingleRequest {
curl_off_t pendingheader; /* this many bytes left to send is actually
header and not body */
struct curltime start; /* transfer started at this time */
unsigned int headerbytecount; /* only count received headers */
unsigned int headerbytecount; /* received server headers (not CONNECT
headers) */
unsigned int allheadercount; /* all received headers (server + CONNECT) */
unsigned int deductheadercount; /* this amount of bytes doesn't count when
we check if anything has been transferred
at the end of a connection. We use this