Skip to content

altsvc: reject bad port numbers #9607

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
bagder wants to merge 2 commits into from
Closed

altsvc: reject bad port numbers #9607

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e9ab5cd
altsvc: reject bad port numbers
bagder Sep 27, 2022
8e5ca27
fixup to only flush on the first added entry - and for clear
bagder Sep 28, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 14 additions & 11 deletions lib/altsvc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -462,6 +462,7 @@ CURLcode Curl_altsvc_parse(struct Curl_easy *data,
struct altsvc *as;
unsigned short dstport = srcport; /* the same by default */
CURLcode result = getalnum(&p, alpnbuf, sizeof(alpnbuf));
size_t entries = 0;
#ifdef CURL_DISABLE_VERBOSE_STRINGS
(void)data;
#endif
Expand All @@ -472,11 +473,10 @@ CURLcode Curl_altsvc_parse(struct Curl_easy *data,

DEBUGASSERT(asi);

/* Flush all cached alternatives for this source origin, if any */
altsvc_flush(asi, srcalpnid, srchost, srcport);

/* "clear" is a magic keyword */
if(strcasecompare(alpnbuf, "clear")) {
/* Flush cached alternatives for this source origin */
altsvc_flush(asi, srcalpnid, srchost, srcport);
return CURLE_OK;
}

Expand All @@ -494,6 +494,7 @@ CURLcode Curl_altsvc_parse(struct Curl_easy *data,
bool quoted = FALSE;
time_t maxage = 24 * 3600; /* default is 24 hours */
bool persist = FALSE;
bool valid = TRUE;
p++;
if(*p != ':') {
/* host name starts here */
Expand All @@ -503,7 +504,7 @@ CURLcode Curl_altsvc_parse(struct Curl_easy *data,
len = p - hostp;
if(!len || (len >= MAX_ALTSVC_HOSTLEN)) {
infof(data, "Excessive alt-svc host name, ignoring.");
dstalpnid = ALPN_none;
valid = FALSE;
}
else {
memcpy(namebuf, hostp, len);
Expand All @@ -520,10 +521,11 @@ CURLcode Curl_altsvc_parse(struct Curl_easy *data,
unsigned long port = strtoul(++p, &end_ptr, 10);
if(port > USHRT_MAX || end_ptr == p || *end_ptr != '\"') {
infof(data, "Unknown alt-svc port number, ignoring.");
dstalpnid = ALPN_none;
valid = FALSE;
}
else
dstport = curlx_ultous(port);
p = end_ptr;
dstport = curlx_ultous(port);
}
if(*p++ != '\"')
break;
Expand Down Expand Up @@ -575,7 +577,12 @@ CURLcode Curl_altsvc_parse(struct Curl_easy *data,
persist = TRUE;
}
}
if(dstalpnid) {
if(dstalpnid && valid) {
if(!entries++)
/* Flush cached alternatives for this source origin, if any - when
this is the first entry of the line. */
altsvc_flush(asi, srcalpnid, srchost, srcport);

as = altsvc_createid(srchost, dsthost,
srcalpnid, dstalpnid,
srcport, dstport);
Expand All @@ -589,10 +596,6 @@ CURLcode Curl_altsvc_parse(struct Curl_easy *data,
Curl_alpnid2str(dstalpnid));
}
}
else {
infof(data, "Unknown alt-svc protocol \"%s\", skipping.",
alpnbuf);
}
}
else
break;
Expand Down
2 changes: 2 additions & 0 deletions tests/data/test356
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,9 @@ Content-Length: 6
Connection: close
Content-Type: text/html
Funny-head: yesyes
Alt-Svc: h1="nowhere.foo:-1"
Alt-Svc: h1="nowhere.foo:81", un-kno22!wn=":82"
Alt-Svc: h1="nowhere.foo:70000"

-foo-
</data>
Expand Down