headers: handle unfold of space-cleansed headers

Detected by OSS-fuzz

Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47767

Updated test 1274

Closes #8947

diff --git a/lib/headers.c b/lib/headers.c
index c21b9481e30208f85e485f63d203abbabcfe82e6..01af85d2d68678315ece6376beb0f772b087d806 100644 (file)
--- a/lib/headers.c
+++ b/lib/headers.c
@@ -227,8 +227,8 @@ static CURLcode unfold_value(struct Curl_easy *data, const char *value,
   DEBUGASSERT(data->state.prevhead);
   hs = data->state.prevhead;
   olen = strlen(hs->value);
-  oalloc = olen + strlen(hs->name) + 1;
   offset = hs->value - hs->buffer;
+  oalloc = olen + offset + 1;
 
   /* skip all trailing space letters */
   while(vlen && ISSPACE(value[vlen - 1]))

diff --git a/tests/data/test1274 b/tests/data/test1274
index ae29f4899ef52e7cae4197901f1eb8b133384653..21d6f61c04716edf3d924432f967a451fa3d1849 100644 (file)
--- a/tests/data/test1274
+++ b/tests/data/test1274
@@ -19,7 +19,8 @@ Server: test-server/
 Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT\r
 ETag: "21025-dc7-39462498"\r
 Content-Length: 6\r
-Connection: close\r
+Connection:                                              \r
+   close\r
 \r
 -foo-
 </data>
@@ -58,7 +59,8 @@ Server: test-server/
 Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT\r
 ETag: "21025-dc7-39462498"\r
 Content-Length: 6\r
-Connection: close\r
+Connection:                                              \r
+   close\r
 \r
 </file>
 </verify>