From: Daniel Stenberg <daniel@haxx.se>
Date: Tue, 31 May 2022 12:03:09 +0000 (+0200)
Subject: headers_push: error out if a folded header has no previous header
X-Git-Tag: curl-7_84_0~114
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b7baa784515c9b36d98c8a626f90ba52e7201dc2;p=thirdparty%2Fcurl.git

headers_push: error out if a folded header has no previous header

As that would indicate an illegal header. The fuzzer reached the assert
in unfold_value() proving that this case can happen.

Follow-up to c9b60f005358a364

Closes #8939
---

diff --git a/lib/headers.c b/lib/headers.c
index 1cedf3d202..c21b9481e3 100644
--- a/lib/headers.c
+++ b/lib/headers.c
@@ -293,9 +293,14 @@ CURLcode Curl_headers_push(struct Curl_easy *data, const char *header,
   }
   hlen = end - header + 1;
 
-  if((header[0] == ' ') || (header[0] == '\t'))
-    /* line folding, append value to the previous header's value */
-    return unfold_value(data, header, hlen);
+  if((header[0] == ' ') || (header[0] == '\t')) {
+    if(data->state.prevhead)
+      /* line folding, append value to the previous header's value */
+      return unfold_value(data, header, hlen);
+    else
+      /* can't unfold without a previous header */
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+  }
 
   hs = calloc(1, sizeof(*hs) + hlen);
   if(!hs)