HTTP/2 PUSH_PROMISE header loss on OOM bypasses scheme validation (regression of 2e8c922a89)
访问控制 / Improper Handling of Insufficient Permissions or Privileges / #3636044
该报告还没有中文解读。
原文摘录
摘自原文（4221 字符中的一小部分）
In `lib/http2.c:1490`, when `curl_maprintf` fails due to memory pressure, the push promise header is silently dropped but the callback returns success. If the lost header is the `:scheme` pseudo-header, the security check at line 733 that blocks HTTPS pushes over insecure connections is skipped …
原文中的代码
curl 8.20.0-DEV (Darwin) libcurl/8.20.0-DEV OpenSSL/3.6.1 zlib/1.2.12 brotli/1.2.0 zstd/1.5.7 libidn2/2.3.8 libssh2/1.11.1 nghttp2/1.66.0 OpenLDAP/2.4.28/Apple Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt mqtts pop3 pop3s rtsp scp sftp smtp smtps …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 curl 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @m42kl33 · 版权归作者与 curl 所有