Verified Commit 2f953af5 authored by Kershaw Chang's avatar Kershaw Chang Committed by ma1
Browse files

Bug 2059199 - Reject NUL bytes in chunked trailer and chunk-size lines a=RyanVM DONTBUILD 

A trailer field line whose first byte is NUL would look empty to the
end-of-trailer check, ending the trailer section early. We would then stop
reading the body before the server (or a shared proxy) does, and disagree
with them about where the response ends.

Original Revision: https://phabricator.services.mozilla.com/D317742

Differential Revision: https://phabricator.services.mozilla.com/D319931
parent 08795680

netwerk/protocol/http/nsHttpChunkedDecoder.cpp

+9 −2
Original line number Diff line number Diff line
@@ -106,8 +106,15 @@ nsresult nsHttpChunkedDecoder::ParseChunkRemaining(char* buf, uint32_t count, 
      count = mLineBuf.Length();

    }



    // NUL is illegal in a chunk-size or trailer field line (RFC 9110 section

    // 5.5).

    if (memchr(buf, '\0', count)) {

      LOG(("chunked line contains embedded NUL; rejecting\n"));

      return NS_ERROR_UNEXPECTED;

    }



    if (mWaitEOF) {

      if (*buf) {

      if (count) {

        LOG(("got trailer: %s\n", buf));

        // allocate a header array for the trailers on demand

        if (!mTrailers) {
@@ -130,7 +137,7 @@ nsresult nsHttpChunkedDecoder::ParseChunkRemaining(char* buf, uint32_t count, 
        mReachedEOF = true;

        LOG(("reached end of chunked-body\n"));

      }

    } else if (*buf) {

    } else if (count) {

      char* endptr;

      unsigned long parsedval;  // could be 64 bit, could be 32