Commit ddb106d7 authored by Tatsuhiro Tsujikawa's avatar Tatsuhiro Tsujikawa Committed by Daniel Stenberg
Browse files

http2: Harden header validation for curl_pushheader_byname 

Since we do prefix match using given header by application code
against header name pair in format "NAME:VALUE", and VALUE part can
contain ":", we have to careful about existence of ":" in header
parameter.  ":" should be allowed to match HTTP/2 pseudo-header field,
and other use of ":" in header must be treated as error, and
curl_pushheader_byname should return NULL.  This commit implements
this behaviour.
parent 77044b53

lib/http2.c

+8 −3
Original line number Diff line number Diff line
@@ -238,9 +238,14 @@ char *curl_pushheader_bynum(struct curl_pushheaders *h, size_t num) 
 */

char *curl_pushheader_byname(struct curl_pushheaders *h, const char *header)

{

  /* Verify that we got a good easy handle in the push header struct, mostly to

     detect rubbish input fast(er). */

  if(!h || !GOOD_EASY_HANDLE(h->data) || !header)

  /* Verify that we got a good easy handle in the push header struct,

     mostly to detect rubbish input fast(er). Also empty header name

     is just a rubbish too. We have to allow ":" at the beginning of

     the header, but header == ":" must be rejected. If we have ':' in

     the middle of header, it could be matched in middle of the value,

     this is because we do prefix match.*/

  if(!h || !GOOD_EASY_HANDLE(h->data) || !header || !header[0] ||

     Curl_raw_equal(header, ":") || strchr(header + 1, ':'))

    return NULL;

  else {

    struct HTTP *stream = h->data->req.protop;