Skip to content

Commit

Permalink
http: unset F_CHUNKED on new Transfer-Encoding
Browse files Browse the repository at this point in the history
Duplicate `Transfer-Encoding` header should be a treated as a single,
but with original header values concatenated with a comma separator. In
the light of this, even if the past `Transfer-Encoding` ended with
`chunked`, we should be not let the `F_CHUNKED` to leak into the next
header, because mere presence of another header indicates that `chunked`
is not the last transfer-encoding token.

CVE-ID: CVE-2020-8287
Refs: nodejs-private/llhttp-private#3
Refs: https://hackerone.com/bugs?report_id=1002188&subject=nodejs
PR-URL: nodejs-private/node-private#228
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
  • Loading branch information
mcollina authored and BethGriggs committed Dec 24, 2020
1 parent 689b50c commit e0c9a22
Showing 1 changed file with 34 additions and 2 deletions.
36 changes: 34 additions & 2 deletions deps/llhttp/src/llhttp.c
Original file line number Diff line number Diff line change
Expand Up @@ -813,6 +813,14 @@ int llhttp__internal__c_or_flags_16(
return 0;
}

int llhttp__internal__c_and_flags(
llhttp__internal_t* state,
const unsigned char* p,
const unsigned char* endp) {
state->flags &= -9;
return 0;
}

int llhttp__internal__c_update_header_state_7(
llhttp__internal_t* state,
const unsigned char* p,
Expand Down Expand Up @@ -5974,10 +5982,18 @@ static llparse_state_t llhttp__internal__run(
/* UNREACHABLE */;
abort();
}
s_n_llhttp__internal__n_invoke_and_flags: {
switch (llhttp__internal__c_and_flags(state, p, endp)) {
default:
goto s_n_llhttp__internal__n_header_value_te_chunked;
}
/* UNREACHABLE */;
abort();
}
s_n_llhttp__internal__n_invoke_or_flags_16: {
switch (llhttp__internal__c_or_flags_16(state, p, endp)) {
default:
goto s_n_llhttp__internal__n_header_value_te_chunked;
goto s_n_llhttp__internal__n_invoke_and_flags;
}
/* UNREACHABLE */;
abort();
Expand Down Expand Up @@ -7625,6 +7641,14 @@ int llhttp__internal__c_or_flags_16(
return 0;
}

int llhttp__internal__c_and_flags(
llhttp__internal_t* state,
const unsigned char* p,
const unsigned char* endp) {
state->flags &= -9;
return 0;
}

int llhttp__internal__c_update_header_state_7(
llhttp__internal_t* state,
const unsigned char* p,
Expand Down Expand Up @@ -12522,10 +12546,18 @@ static llparse_state_t llhttp__internal__run(
/* UNREACHABLE */;
abort();
}
s_n_llhttp__internal__n_invoke_and_flags: {
switch (llhttp__internal__c_and_flags(state, p, endp)) {
default:
goto s_n_llhttp__internal__n_header_value_te_chunked;
}
/* UNREACHABLE */;
abort();
}
s_n_llhttp__internal__n_invoke_or_flags_16: {
switch (llhttp__internal__c_or_flags_16(state, p, endp)) {
default:
goto s_n_llhttp__internal__n_header_value_te_chunked;
goto s_n_llhttp__internal__n_invoke_and_flags;
}
/* UNREACHABLE */;
abort();
Expand Down

0 comments on commit e0c9a22

Please sign in to comment.