]> granicus.if.org Git - curl/commit
http2: Harden header validation for curl_pushheader_byname
authorTatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
Sat, 6 Jun 2015 09:07:00 +0000 (18:07 +0900)
committerDaniel Stenberg <daniel@haxx.se>
Wed, 24 Jun 2015 21:44:42 +0000 (23:44 +0200)
commitddb106d7f62cd6151461f95bf489342822f0dbf5
tree55b2e258a682194c0386783d3b09661844d03c17
parent77044b53f7dc6e1c5c90a8f8bc17847adccdaaaa
http2: Harden header validation for curl_pushheader_byname

Since we do prefix match using given header by application code
against header name pair in format "NAME:VALUE", and VALUE part can
contain ":", we have to careful about existence of ":" in header
parameter.  ":" should be allowed to match HTTP/2 pseudo-header field,
and other use of ":" in header must be treated as error, and
curl_pushheader_byname should return NULL.  This commit implements
this behaviour.
lib/http2.c