a55ea0
From 24dedf9b260eebb7feae6fc273208b551fe54a79 Mon Sep 17 00:00:00 2001
a55ea0
From: Daniel Stenberg <daniel@haxx.se>
a55ea0
Date: Mon, 16 May 2022 16:28:13 +0200
a55ea0
Subject: [PATCH 1/2] content_encoding: return error on too many compression
a55ea0
 steps
a55ea0
a55ea0
The max allowed steps is arbitrarily set to 5.
a55ea0
a55ea0
Bug: https://curl.se/docs/CVE-2022-32206.html
a55ea0
CVE-2022-32206
a55ea0
Reported-by: Harry Sintonen
a55ea0
Closes #9049
a55ea0
a55ea0
Upstream-commit: 3a09fbb7f264c67c438d01a30669ce325aa508e2
a55ea0
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
a55ea0
---
a55ea0
 lib/content_encoding.c | 9 +++++++++
a55ea0
 1 file changed, 9 insertions(+)
a55ea0
a55ea0
diff --git a/lib/content_encoding.c b/lib/content_encoding.c
a55ea0
index c03637a..6f994b3 100644
a55ea0
--- a/lib/content_encoding.c
a55ea0
+++ b/lib/content_encoding.c
a55ea0
@@ -934,6 +934,9 @@ static const content_encoding *find_encoding(const char *name, size_t len)
a55ea0
   return NULL;
a55ea0
 }
a55ea0
 
a55ea0
+/* allow no more than 5 "chained" compression steps */
a55ea0
+#define MAX_ENCODE_STACK 5
a55ea0
+
a55ea0
 /* Set-up the unencoding stack from the Content-Encoding header value.
a55ea0
  * See RFC 7231 section 3.1.2.2. */
a55ea0
 CURLcode Curl_build_unencoding_stack(struct connectdata *conn,
a55ea0
@@ -941,6 +944,7 @@ CURLcode Curl_build_unencoding_stack(struct connectdata *conn,
a55ea0
 {
a55ea0
   struct Curl_easy *data = conn->data;
a55ea0
   struct SingleRequest *k = &data->req;
a55ea0
+  int counter = 0;
a55ea0
 
a55ea0
   do {
a55ea0
     const char *name;
a55ea0
@@ -975,6 +979,11 @@ CURLcode Curl_build_unencoding_stack(struct connectdata *conn,
a55ea0
       if(!encoding)
a55ea0
         encoding = &error_encoding;  /* Defer error at stack use. */
a55ea0
 
a55ea0
+      if(++counter >= MAX_ENCODE_STACK) {
a55ea0
+        failf(data, "Reject response due to %u content encodings",
a55ea0
+              counter);
a55ea0
+        return CURLE_BAD_CONTENT_ENCODING;
a55ea0
+      }
a55ea0
       /* Stack the unencoding stage. */
a55ea0
       writer = new_unencoding_writer(conn, encoding, k->writer_stack);
a55ea0
       if(!writer)
a55ea0
-- 
a55ea0
2.35.3
a55ea0
a55ea0
a55ea0
From b3cd74f01871281f0989860e04c546d896f0e72f Mon Sep 17 00:00:00 2001
a55ea0
From: Daniel Stenberg <daniel@haxx.se>
a55ea0
Date: Mon, 16 May 2022 16:29:07 +0200
a55ea0
Subject: [PATCH 2/2] test387: verify rejection of compression chain attack
a55ea0
a55ea0
Upstream-commit: 7230b19a2e17a164f61f82e4e409a9777ea2421a
a55ea0
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
a55ea0
---
a55ea0
 tests/data/Makefile.inc |  1 +
a55ea0
 tests/data/test387      | 53 +++++++++++++++++++++++++++++++++++++++++
a55ea0
 2 files changed, 54 insertions(+)
a55ea0
 create mode 100644 tests/data/test387
a55ea0
a55ea0
diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
a55ea0
index 98d5516..9b5f4fb 100644
a55ea0
--- a/tests/data/Makefile.inc
a55ea0
+++ b/tests/data/Makefile.inc
a55ea0
@@ -61,6 +61,7 @@ test325 test326 test330 \
a55ea0
 test340 \
a55ea0
 \
a55ea0
 test350 test351 test352 test353 test354 \
a55ea0
+test387 \
a55ea0
 test393 test394 test395 \
a55ea0
 \
a55ea0
 test400 test401 test402 test403 test404 test405 test406 test407 test408 \
a55ea0
diff --git a/tests/data/test387 b/tests/data/test387
a55ea0
new file mode 100644
a55ea0
index 0000000..015ec25
a55ea0
--- /dev/null
a55ea0
+++ b/tests/data/test387
a55ea0
@@ -0,0 +1,53 @@
a55ea0
+<testcase>
a55ea0
+<info>
a55ea0
+<keywords>
a55ea0
+HTTP
a55ea0
+gzip
a55ea0
+</keywords>
a55ea0
+</info>
a55ea0
+
a55ea0
+#
a55ea0
+# Server-side
a55ea0
+<reply>
a55ea0
+<data nocheck="yes">
a55ea0
+HTTP/1.1 200 OK
a55ea0
+Transfer-Encoding: gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip
a55ea0
+
a55ea0
+-foo-
a55ea0
+</data>
a55ea0
+</reply>
a55ea0
+
a55ea0
+#
a55ea0
+# Client-side
a55ea0
+<client>
a55ea0
+<server>
a55ea0
+http
a55ea0
+</server>
a55ea0
+ <name>
a55ea0
+Response with overly long compression chain
a55ea0
+ </name>
a55ea0
+ <command>
a55ea0
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -sS
a55ea0
+</command>
a55ea0
+</client>
a55ea0
+
a55ea0
+#
a55ea0
+# Verify data after the test has been "shot"
a55ea0
+<verify>
a55ea0
+<protocol>
a55ea0
+GET /%TESTNUMBER HTTP/1.1
a55ea0
+Host: %HOSTIP:%HTTPPORT
a55ea0
+User-Agent: curl/7.61.1
a55ea0
+Accept: */*
a55ea0
+
a55ea0
+</protocol>
a55ea0
+
a55ea0
+# CURLE_BAD_CONTENT_ENCODING is 61
a55ea0
+<errorcode>
a55ea0
+61
a55ea0
+</errorcode>
a55ea0
+<stderr mode="text">
a55ea0
+curl: (61) Reject response due to 5 content encodings
a55ea0
+</stderr>
a55ea0
+</verify>
a55ea0
+</testcase>
a55ea0
-- 
a55ea0
2.35.3
a55ea0