From 25e7be39be5f8ed696b6085ced9cf6c17e6128f4 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Mon, 16 May 2022 16:28:13 +0200 Subject: [PATCH] content_encoding: return error on too many compression steps The max allowed steps is arbitrarily set to 5. Bug: https://curl.se/docs/CVE-2022-32206.html CVE-2022-32206 Reported-by: Harry Sintonen Closes #9049 Upstream-Status: Backport [https://github.com/curl/curl/commit/3a09fbb7f264c67c43] Signed-off-by: Robert Joslyn --- lib/content_encoding.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/lib/content_encoding.c b/lib/content_encoding.c index 6d47537..91e621f 100644 --- a/lib/content_encoding.c +++ b/lib/content_encoding.c @@ -934,6 +934,9 @@ static const content_encoding *find_encoding(const char *name, size_t len) return NULL; } +/* allow no more than 5 "chained" compression steps */ +#define MAX_ENCODE_STACK 5 + /* Set-up the unencoding stack from the Content-Encoding header value. * See RFC 7231 section 3.1.2.2. */ CURLcode Curl_build_unencoding_stack(struct connectdata *conn, @@ -941,6 +944,7 @@ CURLcode Curl_build_unencoding_stack(struct connectdata *conn, { struct Curl_easy *data = conn->data; struct SingleRequest *k = &data->req; + int counter = 0; do { const char *name; @@ -975,6 +979,11 @@ CURLcode Curl_build_unencoding_stack(struct connectdata *conn, if(!encoding) encoding = &error_encoding; /* Defer error at stack use. */ + if(++counter >= MAX_ENCODE_STACK) { + failf(data, "Reject response due to %u content encodings", + counter); + return CURLE_BAD_CONTENT_ENCODING; + } /* Stack the unencoding stage. */ writer = new_unencoding_writer(conn, encoding, k->writer_stack); if(!writer)