Change #282059

Comments

mime: bound Curl_mime_prepare_headers() recursion depth

The request-preparation path recursed once per nested multipart level
with no depth limit, so a deeply nested mime tree built by the
application exhausted the stack inside curl_easy_perform().

Thread a call_depth counter through the internal helper, bounded by
MAX_MIME_LEVELS. Deep trees now fail header preparation with
CURLE_TOO_LARGE instead of crashing.

Since header preparation always precedes the read paths, the depth
checks in the mime read functions become redundant and are removed.

Verify with test 3596: deeply nested mime trees fail with
CURLE_TOO_LARGE instead of exhausting the stack.

Fixes #22971
Reported-by: Fengxiaoxx on github
Closes #22980

Changed files

• lib/mime.c
• tests/data/Makefile.am
• tests/data/test3596
• tests/libtest/Makefile.inc
• tests/libtest/lib3596.c