1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
|
From 60d8663afb0fb7f113604404c50840dfe9320039 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Tue, 8 Oct 2024 11:20:40 +0200
Subject: [PATCH] hsts: avoid the local buffer and memcpy on lookup
Closes #15190
Conflict:Context adapt
Reference:https://github.com/curl/curl/commit/60d8663afb0fb7f113604404c50840dfe9320039
---
lib/hsts.c | 22 +++++++++-------------
1 file changed, 9 insertions(+), 13 deletions(-)
diff --git a/lib/hsts.c b/lib/hsts.c
index 7ecf004..f5e5bbf 100644
--- a/lib/hsts.c
+++ b/lib/hsts.c
@@ -250,7 +250,6 @@ struct stsentry *Curl_hsts(struct hsts *h, const char *hostname,
bool subdomain)
{
if(h) {
- char buffer[MAX_HSTS_HOSTLEN + 1];
time_t now = time(NULL);
size_t hlen = strlen(hostname);
struct Curl_llist_element *e;
@@ -258,15 +257,13 @@ struct stsentry *Curl_hsts(struct hsts *h, const char *hostname,
if((hlen > MAX_HSTS_HOSTLEN) || !hlen)
return NULL;
- memcpy(buffer, hostname, hlen);
if(hostname[hlen-1] == '.')
/* remove the trailing dot */
--hlen;
- buffer[hlen] = 0;
- hostname = buffer;
for(e = h->list.head; e; e = n) {
struct stsentry *sts = e->ptr;
+ size_t ntail;
n = e->next;
if(sts->expires <= now) {
/* remove expired entries */
@@ -274,16 +271,15 @@ struct stsentry *Curl_hsts(struct hsts *h, const char *hostname,
hsts_free(sts);
continue;
}
- if(subdomain && sts->includeSubDomains) {
- size_t ntail = strlen(sts->host);
- if(ntail < hlen) {
- size_t offs = hlen - ntail;
- if((hostname[offs-1] == '.') &&
- strncasecompare(&hostname[offs], sts->host, ntail))
- return sts;
- }
+ ntail = strlen(sts->host);
+ if((subdomain && sts->includeSubDomains) && (ntail < hlen)) {
+ size_t offs = hlen - ntail;
+ if((hostname[offs-1] == '.') &&
+ strncasecompare(&hostname[offs], sts->host, ntail))
+ return sts;
}
- if(strcasecompare(hostname, sts->host))
+ /* avoid strcasecompare because the host name is not null terminated */
+ if((hlen == ntail) && strncasecompare(hostname, sts->host, hlen))
return sts;
}
}
--
2.43.0
|
