Fix handling of zero-byte chunk from hyper. #6951

jsha · 2021-04-24T05:54:45Z

When curl is built with Hyper, nghttp2, and most TLS backends (other than crustls), it can produce reads from uninitialized memory. This is due to Hyper providing body chunks of length 0, and hyper_body_chunk passing those to Curl_client_write. When Curl_client_write gets a buf with a len of 0, it calls strlen on buf and uses that as the len:

curl/lib/sendf.c

Lines 604 to 620 in f014eec

    
           /* Curl_client_write() sends data to the write callback(s) 
        
              The bit pattern defines to what "streams" to write to. Body and/or header. 
        
              The defines are in sendf.h of course. 
        
              If CURL_DO_LINEEND_CONV is enabled, data is converted IN PLACE to the 
        
              local character encoding.  This is a problem and should be changed in 
        
              the future to leave the original data alone. 
        
            */ 
        
           CURLcode Curl_client_write(struct Curl_easy *data, 
        
                                      int type, 
        
                                      char *ptr, 
        
                                      size_t len) 
        
           { 
        
             struct connectdata *conn = data->conn; 
        
             if(0 == len) 
        
               len = strlen(ptr);

.

Fixes hyperium/hyper#2512.

Thanks to @kevinburke for reporting.

kevinburke · 2021-04-24T15:09:51Z

I built this patch locally and confirmed it fixed the issue I reported in hyperium/hyper#2512.

bagder · 2021-04-25T12:11:43Z

thanks!

Fix handling of zero-byte chunk from hyper.

26cc8c4

jsha mentioned this pull request Apr 24, 2021

Remove strlen call in Curl_client_write #6952

Closed

bagder approved these changes Apr 25, 2021

View reviewed changes

bagder closed this in 5e7fc49 Apr 25, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix handling of zero-byte chunk from hyper. #6951

Fix handling of zero-byte chunk from hyper. #6951

jsha commented Apr 24, 2021

kevinburke commented Apr 24, 2021

bagder commented Apr 25, 2021

	/* Curl_client_write() sends data to the write callback(s)

	The bit pattern defines to what "streams" to write to. Body and/or header.
	The defines are in sendf.h of course.

	If CURL_DO_LINEEND_CONV is enabled, data is converted IN PLACE to the
	local character encoding. This is a problem and should be changed in
	the future to leave the original data alone.
	*/
	CURLcode Curl_client_write(struct Curl_easy *data,
	int type,
	char *ptr,
	size_t len)
	{
	struct connectdata *conn = data->conn;
	if(0 == len)
	len = strlen(ptr);

Fix handling of zero-byte chunk from hyper. #6951

Fix handling of zero-byte chunk from hyper. #6951

Conversation

jsha commented Apr 24, 2021

kevinburke commented Apr 24, 2021

bagder commented Apr 25, 2021