Unverified Commit da6e24c8 authored by Ben Noordhuis's avatar Ben Noordhuis Committed by Myles Borins
Browse files

deps: reject interior blanks in Content-Length

Original commit message follows:

    Before this commit `Content-Length: 4 2` was accepted as a valid
    header and recorded as `parser->content_length = 42`.  Now it is
    a parse error that fails with error `HPE_INVALID_CONTENT_LENGTH`.

    Downstream users that inspect `parser->content_length` and naively
    parse the string value using `strtoul()` might get confused by the
    discrepancy between the two values.  Resolve that by simply not
    letting it happen.

Fixes: https://github.com/nodejs-private/security/issues/178
PR-URL: https://github.com/nodejs-private/http-parser-private/pull/1


Reviewed-By: default avatarСковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: default avatarColin Ihrig <cjihrig@gmail.com>
Reviewed-By: default avatarEvan Lucas <evanlucas@me.com>
Reviewed-By: default avatarFedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: default avatarJames M Snell <jasnell@gmail.com>
Reviewed-By: default avatarRod Vagg <rod@vagg.org>
parent 7ebc9981
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment