b347b50161
Fix incorrect parsing of the strict-transport-security (HSTS) header Fix buffer over-read via a crafted reply from a DNS server Resolves: bz#2209492
14 lines
627 B
Diff
14 lines
627 B
Diff
--- a/src/network/access/qhsts.cpp
|
|
+++ b/src/network/access/qhsts.cpp
|
|
@@ -364,8 +364,8 @@ quoted-pair = "\" CHAR
|
|
bool QHstsHeaderParser::parse(const QList<QPair<QByteArray, QByteArray>> &headers)
|
|
{
|
|
for (const auto &h : headers) {
|
|
- // We use '==' since header name was already 'trimmed' for us:
|
|
- if (h.first == "Strict-Transport-Security") {
|
|
+ // We compare directly because header name was already 'trimmed' for us:
|
|
+ if (h.first.compare("Strict-Transport-Security", Qt::CaseInsensitive) == 0) {
|
|
header = h.second;
|
|
// RFC6797, 8.1:
|
|
//
|