44 lines
1.5 KiB
Diff
44 lines
1.5 KiB
Diff
|
From 7035676c3daa4f1c3766095561f12e7a0e82c736 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Daniel Stenberg <daniel@haxx.se>
|
||
|
|
Date: Mon, 16 May 2022 16:28:13 +0200
|
||
|
|
Subject: [PATCH] content_encoding: return error on too many compression steps
|
||
|
|
|
||
|
|
The max allowed steps is arbitrarily set to 5.
|
||
|
|
---
|
||
|
|
lib/content_encoding.c | 9 +++++++++
|
||
|
|
1 file changed, 9 insertions(+)
|
||
|
|
|
||
|
|
Index: curl-7.83.1/lib/content_encoding.c
|
||
|
|
===================================================================
|
||
|
|
--- curl-7.83.1.orig/lib/content_encoding.c
|
||
|
|
+++ curl-7.83.1/lib/content_encoding.c
|
||
|
|
@@ -1026,12 +1026,16 @@ static const struct content_encoding *fi
|
||
|
|
return NULL;
|
||
|
|
}
|
||
|
|
|
||
|
|
+/* allow no more than 5 "chained" compression steps */
|
||
|
|
+#define MAX_ENCODE_STACK 5
|
||
|
|
+
|
||
|
|
/* Set-up the unencoding stack from the Content-Encoding header value.
|
||
|
|
* See RFC 7231 section 3.1.2.2. */
|
||
|
|
CURLcode Curl_build_unencoding_stack(struct Curl_easy *data,
|
||
|
|
const char *enclist, int maybechunked)
|
||
|
|
{
|
||
|
|
struct SingleRequest *k = &data->req;
|
||
|
|
+ int counter = 0;
|
||
|
|
|
||
|
|
do {
|
||
|
|
const char *name;
|
||
|
|
@@ -1066,6 +1070,11 @@ CURLcode Curl_build_unencoding_stack(str
|
||
|
|
if(!encoding)
|
||
|
|
encoding = &error_encoding; /* Defer error at stack use. */
|
||
|
|
|
||
|
|
+ if(++counter >= MAX_ENCODE_STACK) {
|
||
|
|
+ failf(data, "Reject response due to %u content encodings",
|
||
|
|
+ counter);
|
||
|
|
+ return CURLE_BAD_CONTENT_ENCODING;
|
||
|
|
+ }
|
||
|
|
/* Stack the unencoding stage. */
|
||
|
|
writer = new_unencoding_writer(data, encoding, k->writer_stack);
|
||
|
|
if(!writer)
|