aboutsummaryrefslogtreecommitdiff
path: root/lib/http.c
diff options
context:
space:
mode:
authorDaniel Stenberg <daniel@haxx.se>2018-02-16 09:49:33 +0100
committerDaniel Stenberg <daniel@haxx.se>2018-02-16 22:51:07 +0100
commit03370fa5a0ac5c1deae4315f01f19e9f1bc53662 (patch)
tree5fb4777f67e9681969a07c274b6d5b3668308f9c /lib/http.c
parent5a44c9fa8b5bc2afc2e0fd97a8bd76522c51987e (diff)
downloadgnurl-03370fa5a0ac5c1deae4315f01f19e9f1bc53662.tar.gz
gnurl-03370fa5a0ac5c1deae4315f01f19e9f1bc53662.tar.bz2
gnurl-03370fa5a0ac5c1deae4315f01f19e9f1bc53662.zip
http: fix the max header length detection logic
Previously, it would only check for max length if the existing alloc buffer was to small to fit it, which often would make the header still get used. Reported-by: Guido Berhoerster Bug: https://curl.haxx.se/mail/lib-2018-02/0056.html Closes #2315
Diffstat (limited to 'lib/http.c')
-rw-r--r--lib/http.c21
1 files changed, 10 insertions, 11 deletions
diff --git a/lib/http.c b/lib/http.c
index f44b18ae9..c1c7b3908 100644
--- a/lib/http.c
+++ b/lib/http.c
@@ -2880,20 +2880,19 @@ static CURLcode header_append(struct Curl_easy *data,
struct SingleRequest *k,
size_t length)
{
- if(k->hbuflen + length >= data->state.headersize) {
+ size_t newsize = k->hbuflen + length;
+ if(newsize > CURL_MAX_HTTP_HEADER) {
+ /* The reason to have a max limit for this is to avoid the risk of a bad
+ server feeding libcurl with a never-ending header that will cause
+ reallocs infinitely */
+ failf(data, "Rejected %zd bytes header (max is %d)!", newsize,
+ CURL_MAX_HTTP_HEADER);
+ return CURLE_OUT_OF_MEMORY;
+ }
+ if(newsize >= data->state.headersize) {
/* We enlarge the header buffer as it is too small */
char *newbuff;
size_t hbufp_index;
- size_t newsize;
-
- if(k->hbuflen + length > CURL_MAX_HTTP_HEADER) {
- /* The reason to have a max limit for this is to avoid the risk of a bad
- server feeding libcurl with a never-ending header that will cause
- reallocs infinitely */
- failf(data, "Avoided giant realloc for header (max is %d)!",
- CURL_MAX_HTTP_HEADER);
- return CURLE_OUT_OF_MEMORY;
- }
newsize = CURLMAX((k->hbuflen + length) * 3 / 2, data->state.headersize*2);
hbufp_index = k->hbufp - data->state.headerbuff;