|
| 1 | +From 7caf9f7ef10cb314f6af9939b8a0cda080e8989d Mon Sep 17 00:00:00 2001 |
| 2 | +From: Bhagyashri Pathak <bhapathak@microsoft.com> |
| 3 | +Date: Tue, 15 Apr 2025 19:08:45 +0530 |
| 4 | +Subject: [PATCH] Patch for CVE-2025-22871 |
| 5 | + |
| 6 | +Upstream patch reference: https://github.com/golang/go/commit/ac1f5aa3d62efe21e65ce4dc30e6996d59acfbd0 |
| 7 | +--- |
| 8 | + src/net/http/internal/chunked.go | 19 ++++++++++++++++--- |
| 9 | + 1 file changed, 16 insertions(+), 3 deletions(-) |
| 10 | + |
| 11 | +diff --git a/src/net/http/internal/chunked.go b/src/net/http/internal/chunked.go |
| 12 | +index 37a72e9..436c3db 100644 |
| 13 | +--- a/src/net/http/internal/chunked.go |
| 14 | ++++ b/src/net/http/internal/chunked.go |
| 15 | +@@ -137,6 +137,19 @@ func readChunkLine(b *bufio.Reader) ([]byte, error) { |
| 16 | + } |
| 17 | + return nil, err |
| 18 | + } |
| 19 | ++ |
| 20 | ++ // RFC 9112 permits parsers to accept a bare \n as a line ending in headers, |
| 21 | ++ // but not in chunked encoding lines. See https://www.rfc-editor.org/errata/eid7633, |
| 22 | ++ // which explicitly rejects a clarification permitting \n as a chunk terminator. |
| 23 | ++ // |
| 24 | ++ // Verify that the line ends in a CRLF, and that no CRs appear before the end. |
| 25 | ++ if idx := bytes.IndexByte(p, '\r'); idx == -1 { |
| 26 | ++ return nil, errors.New("chunked line ends with bare LF") |
| 27 | ++ } else if idx != len(p)-2 { |
| 28 | ++ return nil, errors.New("invalid CR in chunked line") |
| 29 | ++ } |
| 30 | ++ p = p[:len(p)-2] // trim CRLF |
| 31 | ++ |
| 32 | + if len(p) >= maxLineLength { |
| 33 | + return nil, ErrLineTooLong |
| 34 | + } |
| 35 | +@@ -149,14 +162,14 @@ func readChunkLine(b *bufio.Reader) ([]byte, error) { |
| 36 | + } |
| 37 | + |
| 38 | + func trimTrailingWhitespace(b []byte) []byte { |
| 39 | +- for len(b) > 0 && isASCIISpace(b[len(b)-1]) { |
| 40 | ++ for len(b) > 0 && isOWS(b[len(b)-1]) { |
| 41 | + b = b[:len(b)-1] |
| 42 | + } |
| 43 | + return b |
| 44 | + } |
| 45 | + |
| 46 | +-func isASCIISpace(b byte) bool { |
| 47 | +- return b == ' ' || b == '\t' || b == '\n' || b == '\r' |
| 48 | ++func isOWS(b byte) bool { |
| 49 | ++ return b == ' ' || b == '\t' |
| 50 | + } |
| 51 | + |
| 52 | + var semi = []byte(";") |
| 53 | +-- |
| 54 | +2.34.1 |
| 55 | + |
0 commit comments