curl/curl
1
1
Fork 0
mirror of https://github.com/curl/curl.git synced 2025-09-17 17:42:49 +03:00
Code Issues Packages Projects Releases Wiki Activity

headers_push: error out if a folded header has no previous header

Browse Source 
As that would indicate an illegal header. The fuzzer reached the assert
in unfold_value() proving that this case can happen.

Follow-up to c9b60f0053

Closes #8939
This commit is contained in:
Daniel Stenberg 2022-05-31 14:03:09 +02:00
parent 83ee5c428d
commit b7baa78451
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
lib/headers.c
View File

@ -293,9 +293,14 @@ CURLcode Curl_headers_push(struct Curl_easy *data, const char *header,
} }
hlen = end - header + 1; hlen = end - header + 1;
if((header[0] == ' ') || (header[0] == '\t')) if((header[0] == ' ') || (header[0] == '\t')) {
/* line folding, append value to the previous header's value */ if(data->state.prevhead)
return unfold_value(data, header, hlen); /* line folding, append value to the previous header's value */
return unfold_value(data, header, hlen);
else
/* can't unfold without a previous header */
return CURLE_BAD_FUNCTION_ARGUMENT;
}
hs = calloc(1, sizeof(*hs) + hlen); hs = calloc(1, sizeof(*hs) + hlen);
if(!hs) if(!hs)