RTSP ANNOUNCE/SET_PARAMETER upload with --use-ascii / CURLOPT_TRANSFERTEXT sends more body bytes than the declared Content-Length (incomplete fix of e
该报告还没有中文解读。
原文摘录
摘自原文(9704 字符中的一小部分)
curl refuses RTSP uploads that combine a body with `--crlf` / `CURLOPT_CRLF`, because the LF→CRLF conversion makes the number of bytes actually sent differ from the `Content-Length` curl declares to the server. That guard was added as a security fix:
原文中的代码
if(data->set.crlf) {
failf(data, "Cannot do CRLF conversions on upload with RTSP");
return CURLE_BAD_FUNCTION_ARGUMENT;
}
默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 curl 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @joumaaa · 版权归作者与 curl 所有