mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2025-02-17 14:59:45 +08:00
Code Issues Packages Projects Releases Wiki Activity

content_encoding: return error on too many compression steps

Browse Source 
The max allowed steps is arbitrarily set to 5.

Bug: https://curl.se/docs/CVE-2022-32206.html
CVE-2022-32206
Reported-by: Harry Sintonen
Closes #9049
This commit is contained in:
Daniel Stenberg 2022-05-16 16:28:13 +02:00
parent 6ecdf5136b
commit 3a09fbb7f2
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
lib/content_encoding.c
View File

@ -1028,12 +1028,16 @@ static const struct content_encoding *find_encoding(const char *name,
return NULL;
}
/* allow no more than 5 "chained" compression steps */
#define MAX_ENCODE_STACK 5
/* Set-up the unencoding stack from the Content-Encoding header value.
* See RFC 7231 section 3.1.2.2. */
CURLcode Curl_build_unencoding_stack(struct Curl_easy *data,
const char *enclist, int maybechunked)
{
struct SingleRequest *k = &data->req;
int counter = 0;
do {
const char *name;
@ -1068,6 +1072,11 @@ CURLcode Curl_build_unencoding_stack(struct Curl_easy *data,
if(!encoding)
encoding = &error_encoding; /* Defer error at stack use. */
if(++counter >= MAX_ENCODE_STACK) {
failf(data, "Reject response due to %u content encodings",
counter);
return CURLE_BAD_CONTENT_ENCODING;
}
/* Stack the unencoding stage. */
writer = new_unencoding_writer(data, encoding, k->writer_stack);
if(!writer)