Change #282761

Comments

mime: bound Curl_mime_duppart() recursion depth
Curl_mime_duppart() duplicates multipart structures recursively when
cloning an easy handle via curl_easy_duphandle(). Previously, this
traversal did not enforce a recursion limit, allowing an excessively
deep MIME tree to cause unbounded recursion and stack exhaustion.

Bound recursion in mime_duppart() to MAX_MIME_LEVELS, returning
CURLE_TOO_LARGE when exceeded, following the precedent set for
mime_prepare_headers() in c427e91.

Extended test 3596 to verify that curl_easy_duphandle() safely fails for
deeply nested MIME trees.

Closes #23023

Changed files

• lib/mime.c
• tests/libtest/lib3596.c