tree d94e2d14c5b98b39a150d1bd1a6ff88f738fe99c
parent a5fa9d4b7c91aa1c3fecbeb6358ec1127b910dd6
author Katie Hockman <katie@golang.org> 1619196961 -0400
committer Katie Hockman <katie@golang.org> 1619635121 +0000

[release-branch.go1.15] http/httpguts: remove recursion in HeaderValuesContainsToken

Previously, httpguts.HeaderValuesContainsToken called a
function which could recurse to the point of a stack
overflow when given a very large header (~10MB).

Credit to Guido Vranken who reported the crash as
part of the Ethereum 2.0 bounty program.

Fixes CVE-2021-31525

Updates golang/go#45710
Updates golang/go#45711

Change-Id: I2c54ce3b2acf1c5efdea66db0595b93a3f5ae5f3
Reviewed-on: https://go-review.googlesource.com/c/net/+/313069
Trust: Katie Hockman <katie@golang.org>
Run-TryBot: Katie Hockman <katie@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
(cherry picked from commit 89ef3d95e781148a0951956029c92a211477f7f9)
Reviewed-on: https://go-review.googlesource.com/c/net/+/314650
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>