http: use the per-request header counter to check for too large headers

Not the counter that accumulates all headers over all redirects.

Yes: this means that if you allow following unbounded redirects in
never-ending loops, curl can run out of memory.

Fixes #11871
Reported-by: Joshix-1 on github

lib/http.c

@@ -3971,17 +3971,18 @@ CURLcode Curl_bump_headersize(struct Curl_easy *data,
 {
   size_t bad = 0;
   if(delta < MAX_HTTP_RESP_HEADER_SIZE) {
+    data->info.header_size += (unsigned int)delta;
+    data->req.allheadercount += (unsigned int)delta;
     if(!connect_only)
       data->req.headerbytecount += (unsigned int)delta;
-    data->info.header_size += (unsigned int)delta;
-    if(data->info.header_size > MAX_HTTP_RESP_HEADER_SIZE)
-      bad = data->info.header_size;
+    if(data->req.allheadercount > MAX_HTTP_RESP_HEADER_SIZE)
+      bad = data->req.allheadercount;
   }
   else
-    bad = data->info.header_size + delta;
+    bad = data->req.allheadercount + delta;
   if(bad) {
-    failf(data, "Too large response headers: %zu > %u",
-          bad, MAX_HTTP_RESP_HEADER_SIZE);
+    failf(data, "Too large response headers: %zu > %u", bad,
+          MAX_HTTP_RESP_HEADER_SIZE);
     return CURLE_RECV_ERROR;
   }
   return CURLE_OK;

lib/urldata.h

@@ -640,7 +640,9 @@ struct SingleRequest {
   curl_off_t pendingheader;      /* this many bytes left to send is actually
                                     header and not body */
   struct curltime start;         /* transfer started at this time */
-  unsigned int headerbytecount;  /* only count received headers */
+  unsigned int headerbytecount;  /* received server headers (not CONNECT
+                                    headers) */
+  unsigned int allheadercount;   /* all received headers (server + CONNECT) */
   unsigned int deductheadercount; /* this amount of bytes doesn't count when
                                      we check if anything has been transferred
                                      at the end of a connection. We use this