Projects
Mega:23.03
curl
_service:tar_scm:backport-CVE-2023-23916.patch
Sign Up
Log In
Username
Password
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File _service:tar_scm:backport-CVE-2023-23916.patch of Package curl
From 119fb187192a9ea13dc90d9d20c215fc82799ab9 Mon Sep 17 00:00:00 2001 From: Patrick Monnerat <patrick@monnerat.net> Date: Mon, 13 Feb 2023 08:33:09 +0100 Subject: [PATCH] content_encoding: do not reset stage counter for each header Test 418 verifies Closes #10492 Conflict: Context adaptation Reference: https://github.com/curl/curl/commit/119fb187192a9ea13dc --- lib/content_encoding.c | 7 +- lib/urldata.h | 1 + tests/data/Makefile.inc | 2 +- tests/data/test387 | 2 +- tests/data/test418 | 152 ++++++++++++++++++++++++++++++++++++++++ 5 files changed, 158 insertions(+), 6 deletions(-) create mode 100644 tests/data/test418 diff --git a/lib/content_encoding.c b/lib/content_encoding.c index bfc13e2..94344d6 100644 --- a/lib/content_encoding.c +++ b/lib/content_encoding.c @@ -1045,7 +1045,6 @@ CURLcode Curl_build_unencoding_stack(struct Curl_easy *data, const char *enclist, int maybechunked) { struct SingleRequest *k = &data->req; - int counter = 0; do { const char *name; @@ -1080,9 +1079,9 @@ CURLcode Curl_build_unencoding_stack(struct Curl_easy *data, if(!encoding) encoding = &error_encoding; /* Defer error at stack use. */ - if(++counter >= MAX_ENCODE_STACK) { - failf(data, "Reject response due to %u content encodings", - counter); + if(k->writer_stack_depth++ >= MAX_ENCODE_STACK) { + failf(data, "Reject response due to more than %u content encodings", + MAX_ENCODE_STACK); return CURLE_BAD_CONTENT_ENCODING; } /* Stack the unencoding stage. */ diff --git a/lib/urldata.h b/lib/urldata.h index 8246ee8..5ef31f5 100644 --- a/lib/urldata.h +++ b/lib/urldata.h @@ -709,6 +709,7 @@ struct SingleRequest { struct dohdata *doh; /* DoH specific data for this request */ #endif unsigned char setcookies; + unsigned char writer_stack_depth; /* Unencoding stack depth. */ BIT(header); /* incoming data has HTTP header */ BIT(content_range); /* set TRUE if Content-Range: was found */ BIT(upload_done); /* set to TRUE when doing chunked transfer-encoding diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc index 7eb0368..5f128a7 100644 --- a/tests/data/Makefile.inc +++ b/tests/data/Makefile.inc @@ -68,7 +68,7 @@ test380 test381 test383 test384 test385 test386 test387 test388 test389 \ test390 test391 test392 test393 test394 test395 test396 test397 test398 \ test399 test400 test401 test402 test403 test404 test405 test406 test407 \ test408 test409 test410 test411 test412 test413 test414 test415 \ -\ + test418 \ test430 test431 test432 test433 test434 test435 test436 \ \ test440 test441 test442 test443 test444 test445 test446 \ diff --git a/tests/data/test387 b/tests/data/test387 index 015ec25..644fc7f 100644 --- a/tests/data/test387 +++ b/tests/data/test387 @@ -47,7 +47,7 @@ Accept: */* 61 </errorcode> <stderr mode="text"> -curl: (61) Reject response due to 5 content encodings +curl: (61) Reject response due to more than 5 content encodings </stderr> </verify> </testcase> diff --git a/tests/data/test418 b/tests/data/test418 new file mode 100644 index 0000000..50e974e --- /dev/null +++ b/tests/data/test418 @@ -0,0 +1,152 @@ +<testcase> +<info> +<keywords> +HTTP +gzip +</keywords> +</info> + +# +# Server-side +<reply> +<data nocheck="yes"> +HTTP/1.1 200 OK +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip +Transfer-Encoding: gzip + +-foo- +</data> +</reply> + +# +# Client-side +<client> +<server> +http +</server> + <name> +Response with multiple Transfer-Encoding headers + </name> + <command> +http://%HOSTIP:%HTTPPORT/%TESTNUMBER -sS +</command> +</client> + +# +# Verify data after the test has been "shot" +<verify> +<protocol crlf="yes"> +GET /%TESTNUMBER HTTP/1.1 +Host: %HOSTIP:%HTTPPORT +User-Agent: curl/%VERSION +Accept: */* + +</protocol> + +# CURLE_BAD_CONTENT_ENCODING is 61 +<errorcode> +61 +</errorcode> +<stderr mode="text"> +curl: (61) Reject response due to more than 5 content encodings +</stderr> +</verify> +</testcase> -- 2.33.0
Locations
Projects
Search
Status Monitor
Help
Open Build Service
OBS Manuals
API Documentation
OBS Portal
Reporting a Bug
Contact
Mailing List
Forums
Chat (IRC)
Twitter
Open Build Service (OBS)
is an
openSUSE project
.
浙ICP备2022010568号-2