|
| 1 | +diff --git a/lib/hsts.c b/lib/hsts.c |
| 2 | +index a5e7676..69841a2 100644 |
| 3 | +--- a/lib/hsts.c |
| 4 | ++++ b/lib/hsts.c |
| 5 | +@@ -249,12 +249,14 @@ CURLcode Curl_hsts_parse(struct hsts *h, const char *hostname, |
| 6 | + struct stsentry *Curl_hsts(struct hsts *h, const char *hostname, |
| 7 | + bool subdomain) |
| 8 | + { |
| 9 | ++ struct stsentry *bestsub = NULL; |
| 10 | + if(h) { |
| 11 | + char buffer[MAX_HSTS_HOSTLEN + 1]; |
| 12 | + time_t now = time(NULL); |
| 13 | + size_t hlen = strlen(hostname); |
| 14 | + struct Curl_llist_element *e; |
| 15 | + struct Curl_llist_element *n; |
| 16 | ++ size_t blen = 0; |
| 17 | + |
| 18 | + if((hlen > MAX_HSTS_HOSTLEN) || !hlen) |
| 19 | + return NULL; |
| 20 | +@@ -279,15 +281,19 @@ struct stsentry *Curl_hsts(struct hsts *h, const char *hostname, |
| 21 | + if(ntail < hlen) { |
| 22 | + size_t offs = hlen - ntail; |
| 23 | + if((hostname[offs-1] == '.') && |
| 24 | +- strncasecompare(&hostname[offs], sts->host, ntail)) |
| 25 | +- return sts; |
| 26 | ++ strncasecompare(&hostname[offs], sts->host, ntail) && |
| 27 | ++ (ntail > blen)) { |
| 28 | ++ /* save the tail match with the longest tail */ |
| 29 | ++ bestsub = sts; |
| 30 | ++ blen = ntail; |
| 31 | ++ } |
| 32 | + } |
| 33 | + } |
| 34 | + if(strcasecompare(hostname, sts->host)) |
| 35 | + return sts; |
| 36 | + } |
| 37 | + } |
| 38 | +- return NULL; /* no match */ |
| 39 | ++ return bestsub; /* no match */ |
| 40 | + } |
| 41 | + |
| 42 | + /* |
| 43 | +@@ -439,7 +445,7 @@ static CURLcode hsts_add(struct hsts *h, char *line) |
| 44 | + e = Curl_hsts(h, p, subdomain); |
| 45 | + if(!e) |
| 46 | + result = hsts_create(h, p, subdomain, expires); |
| 47 | +- else { |
| 48 | ++ else if(strcasecompare(p, e->host)){ |
| 49 | + /* the same host name, use the largest expire time */ |
| 50 | + if(expires > e->expires) |
| 51 | + e->expires = expires; |
| 52 | +diff --git a/tests/data/test1660 b/tests/data/test1660 |
| 53 | +index f86126d..4b6f961 100644 |
| 54 | +--- a/tests/data/test1660 |
| 55 | ++++ b/tests/data/test1660 |
| 56 | +@@ -52,7 +52,7 @@ this.example [this.example]: 1548400797 |
| 57 | + Input 12: error 43 |
| 58 | + Input 13: error 43 |
| 59 | + Input 14: error 43 |
| 60 | +-3.example.com [example.com]: 1569905261 includeSubDomains |
| 61 | ++3.example.com [3.example.com]: 1569905261 includeSubDomains |
| 62 | + 3.example.com [example.com]: 1569905261 includeSubDomains |
| 63 | + foo.example.com [example.com]: 1569905261 includeSubDomains |
| 64 | + 'foo.xample.com' is not HSTS |
0 commit comments