Bug 1224328 - Don't infinite loop when parsing headers with newlines. r=mcmanus, a=ritu
authorNicholas Hurley <hurley@todesschaf.org>
Thu, 12 Nov 2015 14:44:31 -0800
changeset 305520 e68fb30045aeadb1c4b578e55e8b7ea9ddc86ea8
parent 305519 492f8b630f2215da6a206f12c56df833ff23e15a
child 305521 dd168084d8a452eeece11a4ac7f7f6eaa74fcd33
push id1001
push userraliiev@mozilla.com
push dateMon, 18 Jan 2016 19:06:03 +0000
treeherdermozilla-release@8b89261f3ac4 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmcmanus, ritu
bugs1224328
milestone44.0a2
Bug 1224328 - Don't infinite loop when parsing headers with newlines. r=mcmanus, a=ritu
netwerk/protocol/http/Http2Compression.cpp
--- a/netwerk/protocol/http/Http2Compression.cpp
+++ b/netwerk/protocol/http/Http2Compression.cpp
@@ -857,16 +857,19 @@ Http2Decompressor::DoLiteralInternal(nsA
 
   int32_t newline = 0;
   while ((newline = value.FindChar('\n', newline)) != -1) {
     if (value[newline + 1] == ' ' || value[newline + 1] == '\t') {
       LOG(("Http2Decompressor::Disallowing folded header value %s",
            value.BeginReading()));
       return NS_ERROR_ILLEGAL_VALUE;
     }
+    // Increment this to avoid always finding the same newline and looping
+    // forever
+    ++newline;
   }
 
   LOG(("Http2Decompressor::DoLiteralInternal value %s", value.BeginReading()));
   return NS_OK;
 }
 
 nsresult
 Http2Decompressor::DoLiteralWithoutIndex()