diff options
| author | dartraiden <wowemuh@gmail.com> | 2022-07-02 23:09:35 +0300 |
|---|---|---|
| committer | dartraiden <wowemuh@gmail.com> | 2022-07-02 23:09:35 +0300 |
| commit | 5882ac58f5d5cbcfa9f9d4015285d4f5d2b7c755 (patch) | |
| tree | ab1c3cd0b9893ecfef62702fbb9811f610b8b224 /libs/libcurl/src/content_encoding.c | |
| parent | 59efa751fe2e8189c625b67d9c98b7155e59022e (diff) | |
libcurl: update to 7.84.0
Diffstat (limited to 'libs/libcurl/src/content_encoding.c')
| -rw-r--r-- | libs/libcurl/src/content_encoding.c | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/libs/libcurl/src/content_encoding.c b/libs/libcurl/src/content_encoding.c index c03637a391..95ba48a2dd 100644 --- a/libs/libcurl/src/content_encoding.c +++ b/libs/libcurl/src/content_encoding.c @@ -5,7 +5,7 @@ * | (__| |_| | _ <| |___ * \___|\___/|_| \_\_____| * - * Copyright (C) 1998 - 2021, Daniel Stenberg, <daniel@haxx.se>, et al. + * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al. * * This software is licensed as described in the file COPYING, which * you should have received as part of this distribution. The terms @@ -18,6 +18,8 @@ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY * KIND, either express or implied. * + * SPDX-License-Identifier: curl + * ***************************************************************************/ #include "curl_setup.h" @@ -1026,12 +1028,16 @@ static const struct content_encoding *find_encoding(const char *name, return NULL; } +/* allow no more than 5 "chained" compression steps */ +#define MAX_ENCODE_STACK 5 + /* Set-up the unencoding stack from the Content-Encoding header value. * See RFC 7231 section 3.1.2.2. */ CURLcode Curl_build_unencoding_stack(struct Curl_easy *data, const char *enclist, int maybechunked) { struct SingleRequest *k = &data->req; + int counter = 0; do { const char *name; @@ -1066,6 +1072,11 @@ CURLcode Curl_build_unencoding_stack(struct Curl_easy *data, if(!encoding) encoding = &error_encoding; /* Defer error at stack use. */ + if(++counter >= MAX_ENCODE_STACK) { + failf(data, "Reject response due to %u content encodings", + counter); + return CURLE_BAD_CONTENT_ENCODING; + } /* Stack the unencoding stage. */ writer = new_unencoding_writer(data, encoding, k->writer_stack); if(!writer) |