90 lines
2.5 KiB
Diff
90 lines
2.5 KiB
Diff
commit fb290dfbd8cdb205bd1440cd31e0486637200a8b
|
|
Author: Daniel Stenberg <daniel@haxx.se>
|
|
Date: Mon May 16 16:29:07 2022 +0200
|
|
|
|
[Backport] test387: verify rejection of compression chain attack
|
|
|
|
Offering: RTOS
|
|
CVE: CVE-2022-32206
|
|
Reference: upstream_commit_id=7230b19a2e17a164f61f82e4e409a9777ea2421a
|
|
|
|
DTS/AR: DTS2022063005656
|
|
type: LTS
|
|
reason: fix CVE-2022-32206 for curl.
|
|
weblink:https://github.com/curl/curl/commit/7230b19a2e17a164f61f82e4e409a9777ea2421a
|
|
|
|
Signed-off-by: jiahuasheng <jiahuasheng@h-partners.com>
|
|
|
|
diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
|
|
index cd52a026b..ffcde9f30 100644
|
|
--- a/tests/data/Makefile.inc
|
|
+++ b/tests/data/Makefile.inc
|
|
@@ -61,7 +61,7 @@ test334 test335 test336 test337 test338 test339 test340 test341 test342 \
|
|
test343 test344 test345 test346 test347 test348 test349 test350 test351 \
|
|
test352 test353 test354 test355 test356 test357 test358 test359 test360 \
|
|
test361 test362 test363 test364 \
|
|
-\
|
|
+test387 \
|
|
test393 test394 test395 test396 test397 \
|
|
\
|
|
test400 test401 test402 test403 test404 test405 test406 test407 test408 \
|
|
diff --git a/tests/data/test387 b/tests/data/test387
|
|
new file mode 100644
|
|
index 000000000..015ec25f1
|
|
--- /dev/null
|
|
+++ b/tests/data/test387
|
|
@@ -0,0 +1,53 @@
|
|
+<testcase>
|
|
+<info>
|
|
+<keywords>
|
|
+HTTP
|
|
+gzip
|
|
+</keywords>
|
|
+</info>
|
|
+
|
|
+#
|
|
+# Server-side
|
|
+<reply>
|
|
+<data nocheck="yes">
|
|
+HTTP/1.1 200 OK
|
|
+Transfer-Encoding: gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip,gzip
|
|
+
|
|
+-foo-
|
|
+</data>
|
|
+</reply>
|
|
+
|
|
+#
|
|
+# Client-side
|
|
+<client>
|
|
+<server>
|
|
+http
|
|
+</server>
|
|
+ <name>
|
|
+Response with overly long compression chain
|
|
+ </name>
|
|
+ <command>
|
|
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -sS
|
|
+</command>
|
|
+</client>
|
|
+
|
|
+#
|
|
+# Verify data after the test has been "shot"
|
|
+<verify>
|
|
+<protocol>
|
|
+GET /%TESTNUMBER HTTP/1.1
|
|
+Host: %HOSTIP:%HTTPPORT
|
|
+User-Agent: curl/%VERSION
|
|
+Accept: */*
|
|
+
|
|
+</protocol>
|
|
+
|
|
+# CURLE_BAD_CONTENT_ENCODING is 61
|
|
+<errorcode>
|
|
+61
|
|
+</errorcode>
|
|
+<stderr mode="text">
|
|
+curl: (61) Reject response due to 5 content encodings
|
|
+</stderr>
|
|
+</verify>
|
|
+</testcase>
|