File curl-CVE-2023-23916.patch of Package curl.27750

Overview Repositories Revisions Requests Users Attributes Meta

File curl-CVE-2023-23916.patch of Package curl.27750

From 8c12d047af5849d9d498e13b21a3aaef38e6049f Mon Sep 17 00:00:00 2001
From: Patrick Monnerat <patrick@monnerat.net>
Date: Mon, 6 Feb 2023 15:00:43 +0100
Subject: [PATCH] content_encoding: do not reset stage counter for each header

---
 lib/content_encoding.c  |   7 +-
 lib/urldata.h           |   1 +

Index: curl-7.79.1/lib/content_encoding.c
===================================================================
--- curl-7.79.1.orig/lib/content_encoding.c
+++ curl-7.79.1/lib/content_encoding.c
@@ -1034,7 +1034,6 @@ CURLcode Curl_build_unencoding_stack(str
                                      const char *enclist, int maybechunked)
 {
   struct SingleRequest *k = &data->req;
-  int counter = 0;
 
   do {
     const char *name;
@@ -1069,9 +1068,9 @@ CURLcode Curl_build_unencoding_stack(str
       if(!encoding)
         encoding = &error_encoding;  /* Defer error at stack use. */
 
-      if(++counter >= MAX_ENCODE_STACK) {
-        failf(data, "Reject response due to %u content encodings",
-              counter);
+      if(k->writer_stack_depth++ >= MAX_ENCODE_STACK) {
+        failf(data, "Reject response due to more than %u content encodings",
+              MAX_ENCODE_STACK);
         return CURLE_BAD_CONTENT_ENCODING;
       }
       /* Stack the unencoding stage. */
Index: curl-7.79.1/lib/urldata.h
===================================================================
--- curl-7.79.1.orig/lib/urldata.h
+++ curl-7.79.1/lib/urldata.h
@@ -706,6 +706,7 @@ struct SingleRequest {
   struct dohdata *doh; /* DoH specific data for this request */
 #endif
   unsigned char setcookies;
+  unsigned char writer_stack_depth; /* Unencoding stack depth. */
   BIT(header);        /* incoming data has HTTP header */
   BIT(content_range); /* set TRUE if Content-Range: was found */
   BIT(upload_done);   /* set to TRUE when doing chunked transfer-encoding

Places

File curl-CVE-2023-23916.patch of Package curl.27750

Places