bad headers can come in two kinds, we either treat everything as one big

badly assumed header, or we think that parts of the buffer is a bad header
and the rest is treated as a normal body part

lib/transfer.c

@@ -294,7 +294,7 @@ CURLcode Curl_readwrite(struct connectdata *conn,
               if(!strnequal(data->state.headerbuff, "HTTP/", 5)) {
                 /* this is not the beginning of a HTTP first header line */
                 k->header = FALSE;
-                k->badheader = TRUE;
+                k->badheader = HEADER_ALLBAD;
                 break;
               }
             }
@@ -342,6 +342,17 @@ CURLcode Curl_readwrite(struct connectdata *conn,
            * We now have a FULL header line that p points to
            *****/
 
+          if(!k->headerline) {
+            /* the first read header */
+            if((k->hbuflen>5) &&
+               !strnequal(data->state.headerbuff, "HTTP/", 5)) {
+              /* this is not the beginning of a HTTP first header line */
+              k->header = FALSE;
+              k->badheader = HEADER_PARTHEADER;
+              break;
+            }
+          }
+
           if (('\n' == *k->p) || ('\r' == *k->p)) {
             int headerlen;
             /* Zero-length header line means end of headers! */
@@ -505,7 +516,6 @@ CURLcode Curl_readwrite(struct connectdata *conn,
             }
             else {
               k->header = FALSE;   /* this is not a header line */
-              k->badheader = TRUE; /* this was a bad header */
               break;
             }
           }
@@ -764,8 +774,16 @@ CURLcode Curl_readwrite(struct connectdata *conn,
         k->bodywrites++;
 
         /* pass data to the debug function before it gets "dechunked" */
-        if(data->set.verbose)
-          Curl_debug(data, CURLINFO_DATA_IN, k->str, nread);
+        if(data->set.verbose) {
+          if(k->badheader) {
+            Curl_debug(data, CURLINFO_DATA_IN, data->state.headerbuff,
+                       k->hbuflen);
+            if(k->badheader == HEADER_PARTHEADER)
+              Curl_debug(data, CURLINFO_DATA_IN, k->str, nread);
+          }
+          else
+            Curl_debug(data, CURLINFO_DATA_IN, k->str, nread);
+        }
 
         if(conn->bits.chunk) {
           /*
@@ -820,9 +838,8 @@ CURLcode Curl_readwrite(struct connectdata *conn,
             result = Curl_client_write(data, CLIENTWRITE_BODY,
                                        data->state.headerbuff,
                                        k->hbuflen);
-            k->badheader = FALSE; /* taken care of now */
           }
-          else {
+          if(k->badheader < HEADER_ALLBAD) {
             /* This switch handles various content encodings. If there's an
                error here, be sure to check over the almost identical code in
                http_chunk.c. 08/29/02 jhrg */
@@ -855,6 +872,7 @@ CURLcode Curl_readwrite(struct connectdata *conn,
             }
 #endif
           }
+          k->badheader = HEADER_NORMAL; /* taken care of now */
 
           if(result)
             return result;

lib/urldata.h

@@ -229,7 +229,12 @@ struct Curl_transfer_keeper {
   struct timeval start;         /* transfer started at this time */
   struct timeval now;           /* current time */
   bool header;	                /* incoming data has HTTP header */
-  bool badheader;		/* the header was deemed bad and will be
+  enum {
+    HEADER_NORMAL,      /* no bad header at all */
+    HEADER_PARTHEADER,  /* part of the chunk is a bad header, the rest is
+                           normal data */
+    HEADER_ALLBAD       /* all was believed to be header */
+  } badheader;		        /* the header was deemed bad and will be
                                    written as body */
   int headerline;		/* counts header lines to better track the
                                    first one */