diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2022-05-16 16:28:13 +0200 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2022-06-25 22:14:21 +0200 |
| commit | 3a09fbb7f264c67c438d01a30669ce325aa508e2 (patch) | |
| tree | a759791a468d81ab37749239ba06e3d44807daec | |
| parent | 6ecdf5136b52af747e7bda08db9a748256b1cd09 (diff) | |
| download | curl-3a09fbb7f264c67c438d01a30669ce325aa508e2.tar.gz | |
content_encoding: return error on too many compression steps
The max allowed steps is arbitrarily set to 5.
Bug: https://curl.se/docs/CVE-2022-32206.html
CVE-2022-32206
Reported-by: Harry Sintonen
Closes #9049
| -rw-r--r-- | lib/content_encoding.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/lib/content_encoding.c b/lib/content_encoding.c index c5591ca48..95ba48a2d 100644 --- a/lib/content_encoding.c +++ b/lib/content_encoding.c @@ -1028,12 +1028,16 @@ static const struct content_encoding *find_encoding(const char *name, return NULL; } +/* allow no more than 5 "chained" compression steps */ +#define MAX_ENCODE_STACK 5 + /* Set-up the unencoding stack from the Content-Encoding header value. * See RFC 7231 section 3.1.2.2. */ CURLcode Curl_build_unencoding_stack(struct Curl_easy *data, const char *enclist, int maybechunked) { struct SingleRequest *k = &data->req; + int counter = 0; do { const char *name; @@ -1068,6 +1072,11 @@ CURLcode Curl_build_unencoding_stack(struct Curl_easy *data, if(!encoding) encoding = &error_encoding; /* Defer error at stack use. */ + if(++counter >= MAX_ENCODE_STACK) { + failf(data, "Reject response due to %u content encodings", + counter); + return CURLE_BAD_CONTENT_ENCODING; + } /* Stack the unencoding stage. */ writer = new_unencoding_writer(data, encoding, k->writer_stack); if(!writer) |