http2: double http request parser max line length

This works around #11138, by doubling the limit, and should be a
relatively safe fix.

Ideally the buffer would grow as needed and there would be no need for a
limit? But that might be follow-up material.

Fixes #11138
Closes #11139

diff --git a/lib/http1.h b/lib/http1.h
index c2d107587a6f804618644bf7e875c0a0569874f4..8acb9db401a95e275785324727a10f85e53dac35 100644 (file)
--- a/lib/http1.h
+++ b/lib/http1.h
@@ -33,6 +33,8 @@
 #define H1_PARSE_OPT_NONE       (0)
 #define H1_PARSE_OPT_STRICT     (1 << 0)
 
+#define H1_PARSE_DEFAULT_MAX_LINE_LEN (8 * 1024)
+
 struct h1_req_parser {
   struct http_req *req;
   struct bufq scratch;

diff --git a/lib/http2.c b/lib/http2.c
index 47e6f71393156c72ded830653279615402af1313..4e3b182b8d815d66a3ecdf2f65d9ef0aa30dd575 100644 (file)
--- a/lib/http2.c
+++ b/lib/http2.c
@@ -1860,7 +1860,7 @@ static ssize_t h2_submit(struct stream_ctx **pstream,
   nghttp2_priority_spec pri_spec;
   ssize_t nwritten;
 
-  Curl_h1_req_parse_init(&h1, (4*1024));
+  Curl_h1_req_parse_init(&h1, H1_PARSE_DEFAULT_MAX_LINE_LEN);
   Curl_dynhds_init(&h2_headers, 0, DYN_HTTP_REQUEST);
 
   *err = http2_data_setup(cf, data, &stream);

diff --git a/lib/vquic/curl_msh3.c b/lib/vquic/curl_msh3.c
index 40e89379fc4028380040df1179a14edf930cbe5e..173886739b6dc06516cc536b3ed793e6d4082f4c 100644 (file)
--- a/lib/vquic/curl_msh3.c
+++ b/lib/vquic/curl_msh3.c
@@ -575,7 +575,7 @@ static ssize_t cf_msh3_send(struct Curl_cfilter *cf, struct Curl_easy *data,
 
   CF_DATA_SAVE(save, cf, data);
 
-  Curl_h1_req_parse_init(&h1, (4*1024));
+  Curl_h1_req_parse_init(&h1, H1_PARSE_DEFAULT_MAX_LINE_LEN);
   Curl_dynhds_init(&h2_headers, 0, DYN_HTTP_REQUEST);
 
   /* Sizes must match for cast below to work" */

diff --git a/lib/vquic/curl_ngtcp2.c b/lib/vquic/curl_ngtcp2.c
index 05f960afdffa1a22215f62ba4ba6817d10618a50..7794f148c6ec925fdee066c44881111e158c63d8 100644 (file)
--- a/lib/vquic/curl_ngtcp2.c
+++ b/lib/vquic/curl_ngtcp2.c
@@ -1550,7 +1550,7 @@ static ssize_t h3_stream_open(struct Curl_cfilter *cf,
   nghttp3_data_reader reader;
   nghttp3_data_reader *preader = NULL;
 
-  Curl_h1_req_parse_init(&h1, (4*1024));
+  Curl_h1_req_parse_init(&h1, H1_PARSE_DEFAULT_MAX_LINE_LEN);
   Curl_dynhds_init(&h2_headers, 0, DYN_HTTP_REQUEST);
 
   *err = h3_data_setup(cf, data);

diff --git a/lib/vquic/curl_quiche.c b/lib/vquic/curl_quiche.c
index 392b9beb83c599f0b3f33d199e618a274520d896..c63e8e10a22e076d4dbbef912282deb2d6dafb86 100644 (file)
--- a/lib/vquic/curl_quiche.c
+++ b/lib/vquic/curl_quiche.c
@@ -913,7 +913,7 @@ static ssize_t h3_open_stream(struct Curl_cfilter *cf,
     DEBUGASSERT(stream);
   }
 
-  Curl_h1_req_parse_init(&h1, (4*1024));
+  Curl_h1_req_parse_init(&h1, H1_PARSE_DEFAULT_MAX_LINE_LEN);
   Curl_dynhds_init(&h2_headers, 0, DYN_HTTP_REQUEST);
 
   DEBUGASSERT(stream);