File curl-CVE-2023-23916.patch of Package curl-mini.28980

Overview Repositories Revisions Requests Users Attributes Meta

File curl-CVE-2023-23916.patch of Package curl-mini.28980

From 8c12d047af5849d9d498e13b21a3aaef38e6049f Mon Sep 17 00:00:00 2001
From: Patrick Monnerat <patrick@monnerat.net>
Date: Mon, 6 Feb 2023 15:00:43 +0100
Subject: [PATCH] content_encoding: do not reset stage counter for each header

---
 lib/content_encoding.c  |   7 +-
 lib/urldata.h           |   1 +

Index: curl-7.66.0/lib/content_encoding.c
===================================================================
--- curl-7.66.0.orig/lib/content_encoding.c
+++ curl-7.66.0/lib/content_encoding.c
@@ -944,7 +944,6 @@ CURLcode Curl_build_unencoding_stack(str
 {
   struct Curl_easy *data = conn->data;
   struct SingleRequest *k = &data->req;
-  int counter = 0;
 
   do {
     const char *name;
@@ -979,9 +978,9 @@ CURLcode Curl_build_unencoding_stack(str
       if(!encoding)
         encoding = &error_encoding;  /* Defer error at stack use. */
 
-      if(++counter >= MAX_ENCODE_STACK) {
-        failf(data, "Reject response due to %u content encodings",
-              counter);
+      if(k->writer_stack_depth++ >= MAX_ENCODE_STACK) {
+        failf(data, "Reject response due to more than %u content encodings",
+              MAX_ENCODE_STACK);
         return CURLE_BAD_CONTENT_ENCODING;
       }
 
Index: curl-7.66.0/lib/urldata.h
===================================================================
--- curl-7.66.0.orig/lib/urldata.h
+++ curl-7.66.0/lib/urldata.h
@@ -615,6 +615,7 @@ struct SingleRequest {
 #ifndef CURL_DISABLE_DOH
   struct dohdata doh; /* DoH specific data for this request */
 #endif
+  unsigned char writer_stack_depth; /* Unencoding stack depth. */
   bit header:1;       /* incoming data has HTTP header */
   bit content_range:1; /* set TRUE if Content-Range: was found */
   bit upload_done:1;  /* set to TRUE when doing chunked transfer-encoding

Places

File curl-CVE-2023-23916.patch of Package curl-mini.28980

Places