From: Daniel Stenberg <daniel@haxx.se>
Date: Tue, 26 Oct 2021 15:47:14 +0000 (+0200)
Subject: http: reject HTTP response codes < 100
X-Git-Tag: curl-7_80_0~51
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c67a32fc560913caff7875bb4fe98abb9991798c;p=thirdparty%2Fcurl.git

http: reject HTTP response codes < 100

... which then also includes negative ones as test 1430 uses.

This makes native + hyper backend act identically on this and therefore
test 1430 can now be enabled when building with hyper. Adjust test 1431
as well.

Closes #7909
---

diff --git a/lib/http.c b/lib/http.c
index 4777750ec2..78ad10edea 100644
--- a/lib/http.c
+++ b/lib/http.c
@@ -4240,8 +4240,12 @@ CURLcode Curl_http_readwrite_headers(struct Curl_easy *data,
 
         /* There can only be a 4th response code digit stored in 'digit4' if
            all the other fields were parsed and stored first, so nc is 5 when
-           digit4 a digit */
-        else if(ISDIGIT(digit4)) {
+           digit4 a digit.
+
+           The sscanf() line above will also allow zero-prefixed and negative
+           numbers, so we check for that too here.
+        */
+        else if(ISDIGIT(digit4) || (k->httpcode < 100)) {
           failf(data, "Unsupported response code in HTTP response");
           return CURLE_UNSUPPORTED_PROTOCOL;
         }
diff --git a/tests/data/DISABLED b/tests/data/DISABLED
index c6998993d2..792bfb090e 100644
--- a/tests/data/DISABLED
+++ b/tests/data/DISABLED
@@ -65,8 +65,6 @@
 1156
 1160
 1417
-1430
-1431
 1455
 1456
 1525
diff --git a/tests/data/test1430 b/tests/data/test1430
index 3dbeae8560..8ed513c606 100644
--- a/tests/data/test1430
+++ b/tests/data/test1430
@@ -7,7 +7,7 @@ HTTP GET
 </info>
 
 <reply>
-<data>
+<data nocheck="yes">
 HTTP/1.1 -12 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -47,5 +47,10 @@ User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
+# 1 - CURLE_UNSUPPORTED_PROTOCOL
+# Due to invalid HTTP response code
+<errorcode>
+1
+</errorcode>
 </verify>
 </testcase>
diff --git a/tests/data/test1431 b/tests/data/test1431
index be6277d89b..26cf4aaf79 100644
--- a/tests/data/test1431
+++ b/tests/data/test1431
@@ -7,7 +7,7 @@ HTTP GET
 </info>
 
 <reply>
-<data>
+<data nocheck="yes">
 HTTP/1.1 2 OK
 Date: Tue, 09 Nov 2010 14:49:00 GMT
 Server: test-server/fake
@@ -47,5 +47,8 @@ User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>
+<errorcode>
+1
+</errorcode>
 </verify>
 </testcase>