http2: check push header names by length first

Reported-by: Joshua Rogers
Closes #18930

diff --git a/lib/http2.c b/lib/http2.c
index c33c633cf632aa4a936e41ee0155abcf268aba88..ff53fc4b947dc97b0085532f9f33c8f395ba8801 100644 (file)
--- a/lib/http2.c
+++ b/lib/http2.c
@@ -1590,7 +1590,8 @@ static int on_header(nghttp2_session *session, const nghttp2_frame *frame,
   if(frame->hd.type == NGHTTP2_PUSH_PROMISE) {
     char *h;
 
-    if(!strcmp(HTTP_PSEUDO_AUTHORITY, (const char *)name)) {
+    if((namelen == (sizeof(HTTP_PSEUDO_AUTHORITY)-1)) &&
+       !strncmp(HTTP_PSEUDO_AUTHORITY, (const char *)name, namelen)) {
       /* pseudo headers are lower case */
       int rc = 0;
       char *check = curl_maprintf("%s:%d", cf->conn->host.name,