mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2024-12-21 06:50:10 +08:00
Code Issues Packages Projects Releases Wiki Activity

hsts: avoid the local buffer and memcpy on lookup

Browse Source 
Closes #15190
This commit is contained in:
Daniel Stenberg 2024-10-08 11:20:40 +02:00
parent 3e7a6fbb8e
commit 60d8663afb
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 9 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
lib/hsts.c
View File

@ -250,7 +250,6 @@ struct stsentry *Curl_hsts(struct hsts *h, const char *hostname,
bool subdomain) bool subdomain)
{ {
if(h) { if(h) {
char buffer[MAX_HSTS_HOSTLEN + 1];
time_t now = time(NULL); time_t now = time(NULL);
size_t hlen = strlen(hostname); size_t hlen = strlen(hostname);
struct Curl_llist_node *e; struct Curl_llist_node *e;
@ -258,15 +257,13 @@ struct stsentry *Curl_hsts(struct hsts *h, const char *hostname,
if((hlen > MAX_HSTS_HOSTLEN) || !hlen) if((hlen > MAX_HSTS_HOSTLEN) || !hlen)
return NULL; return NULL;
memcpy(buffer, hostname, hlen);
if(hostname[hlen-1] == '.') if(hostname[hlen-1] == '.')
/* remove the trailing dot */ /* remove the trailing dot */
--hlen; --hlen;
buffer[hlen] = 0;
hostname = buffer;
for(e = Curl_llist_head(&h->list); e; e = n) { for(e = Curl_llist_head(&h->list); e; e = n) {
struct stsentry *sts = Curl_node_elem(e); struct stsentry *sts = Curl_node_elem(e);
size_t ntail;
n = Curl_node_next(e); n = Curl_node_next(e);
if(sts->expires <= now) { if(sts->expires <= now) {
/* remove expired entries */ /* remove expired entries */
@ -274,16 +271,15 @@ struct stsentry *Curl_hsts(struct hsts *h, const char *hostname,
hsts_free(sts); hsts_free(sts);
continue; continue;
} }
if(subdomain && sts->includeSubDomains) { ntail = strlen(sts->host);
size_t ntail = strlen(sts->host); if((subdomain && sts->includeSubDomains) && (ntail < hlen)) {
if(ntail < hlen) { size_t offs = hlen - ntail;
size_t offs = hlen - ntail; if((hostname[offs-1] == '.') &&
if((hostname[offs-1] == '.') && strncasecompare(&hostname[offs], sts->host, ntail))
strncasecompare(&hostname[offs], sts->host, ntail)) return sts;
return sts;
}
} }
if(strcasecompare(hostname, sts->host)) /* avoid strcasecompare because the host name is not null terminated */
if((hlen == ntail) && strncasecompare(hostname, sts->host, hlen))
return sts; return sts;
} }
} }