From 0fe3adec199e8cd2c101933f75d8cd617de70350 Mon Sep 17 00:00:00 2001 From: Hitendra Prajapati Date: Fri, 26 Aug 2022 12:48:13 +0530 Subject: [PATCH] CVE-2022-32148 Upstream-Status: Backport [https://github.com/golang/go/commit/ed2f33e1a7e0d18f61bd56f7ee067331d612c27e] CVE: CVE-2022-32148 Signed-off-by: Hitendra Prajapati --- src/net/http/header.go | 6 ++++++ src/net/http/header_test.go | 5 +++++ 2 files changed, 11 insertions(+) diff --git a/src/net/http/header.go b/src/net/http/header.go index b9b5391..221f613 100644 --- a/src/net/http/header.go +++ b/src/net/http/header.go @@ -100,6 +100,12 @@ func (h Header) Clone() Header { sv := make([]string, nv) // shared backing array for headers' values h2 := make(Header, len(h)) for k, vv := range h { + if vv == nil { + // Preserve nil values. ReverseProxy distinguishes + // between nil and zero-length header values. + h2[k] = nil + continue + } n := copy(sv, vv) h2[k] = sv[:n:n] sv = sv[n:] diff --git a/src/net/http/header_test.go b/src/net/http/header_test.go index 4789362..80c0035 100644 --- a/src/net/http/header_test.go +++ b/src/net/http/header_test.go @@ -235,6 +235,11 @@ func TestCloneOrMakeHeader(t *testing.T) { in: Header{"foo": {"bar"}}, want: Header{"foo": {"bar"}}, }, + { + name: "nil value", + in: Header{"foo": nil}, + want: Header{"foo": nil}, + }, } for _, tt := range tests { -- 2.25.1