From f5f8b90ec841dc3781b9947557c14b9337d778f0 Mon Sep 17 00:00:00 2001 From: Gunnar Beutner Date: Wed, 31 Jan 2018 09:05:06 +0100 Subject: [PATCH] Add HTTP Header size limits --- lib/remote/httprequest.cpp | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/lib/remote/httprequest.cpp b/lib/remote/httprequest.cpp index 0a2f161ab..b29088092 100644 --- a/lib/remote/httprequest.cpp +++ b/lib/remote/httprequest.cpp @@ -45,8 +45,15 @@ bool HttpRequest::Parse(StreamReadContext& src, bool may_wait) String line; StreamReadStatus srs = m_Stream->ReadLine(&line, src, may_wait); - if (srs != StatusNewItem) + if (srs != StatusNewItem) { + if (src.Size > 512) + BOOST_THROW_EXCEPTION(std::invalid_argument("Line length for HTTP header exceeded")); + return false; + } + + if (line.GetLength() > 512) + BOOST_THROW_EXCEPTION(std::invalid_argument("Line length for HTTP header exceeded")); if (m_State == HttpRequestStart) { /* ignore trailing new-lines */ @@ -84,6 +91,9 @@ bool HttpRequest::Parse(StreamReadContext& src, bool may_wait) return true; } else { + if (Headers->GetLength() > 128) + BOOST_THROW_EXCEPTION(std::invalid_argument("Maximum number of HTTP request headers exceeded")); + String::SizeType pos = line.FindFirstOf(":"); if (pos == String::NPos) BOOST_THROW_EXCEPTION(std::invalid_argument("Invalid HTTP request")); -- 2.40.0