f0f84d1251
Graham Campbell
2026-07-21
Subject
http: avoid length underflow in Curl_compareheader
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
lib/http.c+4 -0
| @@ -1440,6 +1440,10 @@ bool Curl_compareheader(const char *headerline, /* line to check */ | |
| do | |
| curlx_str_passblanks(&p); | |
| while(!curlx_str_single(&p, ',')); | |
| + | /* trailing blanks may move the parsing point past the value end, |
| + | then there is nothing left to match */ |
| + | if((size_t)(p - o) > len) |
| + | break; |
| len -= (p - o); | |
| } | |
| } | |
tests/data/test1625+1 -1
| @@ -19,7 +19,7 @@ Curl_compareheader unit test | |
| <verify> | |
| <stdout mode="text"> | |
| - | 31 invokes |
| + | 33 invokes |
| </stdout> | |
| </verify> | |
| </testcase> | |
tests/unit/unit1625.c+5 -0
| @@ -102,6 +102,11 @@ static CURLcode test_unit1625(const char *arg) | |
| { "Encoding: super-nice", "Encoding:", "super-nice", TRUE }, | |
| /* hyphenated second token */ | |
| { "Encoding: extra-good, super-nice", "Encoding:", "super-nice", TRUE }, | |
| + | /* trailing blanks after the last comma */ |
| + | { "Encoding: gzipped, ", "Encoding:", "gzip", FALSE }, |
| + | /* the scan must not cross into a second line */ |
| + | { "Encoding: gzipped, \r\nEncoding: gzip, chunked", "Encoding:", |
| + | "chunked", FALSE }, |
| }; | |
| for(i = 0; i < CURL_ARRAYSIZE(list); i++) { | |