[openssl/openssl] 7f8aba: Limit the number of http headers when receiving th...

[Sashan]

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: 7f8aba2f44e9ca65b8a95987fa6c46020e1bdd6d
      https://github.com/openssl/openssl/commit/7f8aba2f44e9ca65b8a95987fa6c46020e1bdd6d
  Author: Alexandr Nedvedicky <sashan at openssl.org>
  Date:   2024-03-12 (Tue, 12 Mar 2024)

  Changed paths:
    M CHANGES.md
    M crypto/err/openssl.txt
    M crypto/http/http_client.c
    M crypto/http/http_err.c
    M doc/man3/OSSL_HTTP_REQ_CTX.pod
    M include/crypto/httperr.h
    M include/openssl/http.h
    M include/openssl/httperr.h
    M test/http_test.c
    M util/libcrypto.num

  Log Message:
  -----------
  Limit the number of http headers when receiving the http response

Change introduces a default limit on HTTP headers we expect to receive
from server to 256. If limit is exceeded http client library indicates
HTTP_R_RESPONSE_TOO_MANY_HDRLINES error. Application can use
OSSL_HTTP_REQ_CTX_set_max_response_hdr_lines() to change default.
Setting limit to 0 implies no limit (current behavior).

Fixes #22264

Reviewed-by: Matt Caswell <matt at openssl.org>
Reviewed-by: Tomas Mraz <tomas at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23781)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications