From f1097813a30ced07b324daa9699f07dba3b202fa Mon Sep 17 00:00:00 2001
From: nagachika <nagachika@ruby-lang.org>
Date: Sat, 9 Dec 2023 16:50:08 +0900
Subject: merge revision(s)
 d8b8294c28a09278de357c26b291abf1b9f3cc5d,eedcd696a57521a18963d58487db8057a374a67a,bc0a7a641b6d0d3ff979cfa11e25683f8fa59ebd:

	[ruby/net-http] Limit header length

	https://github.com/ruby/net-http/commit/c245f7f9c8
	---
	 lib/net/http/header.rb | 8 ++++++++
	 1 file changed, 8 insertions(+)

	[ruby/net-http] Fix previous commit

	https://github.com/ruby/net-http/commit/1b276e2654
	---
	 lib/net/http/header.rb | 4 ++--
	 1 file changed, 2 insertions(+), 2 deletions(-)

	[ruby/net-http] typofix

	https://github.com/ruby/net-http/commit/4d31bde125
	---
	 lib/net/http/header.rb | 2 +-
	 1 file changed, 1 insertion(+), 1 deletion(-)
---
 lib/net/http/header.rb | 8 ++++++++
 version.h              | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/lib/net/http/header.rb b/lib/net/http/header.rb
index 40c119a353..3c061abb83 100644
--- a/lib/net/http/header.rb
+++ b/lib/net/http/header.rb
@@ -179,6 +179,8 @@
 # - #each_value: Passes each string field value to the block.
 #
 module Net::HTTPHeader
+  MAX_KEY_LENGTH = 1024
+  MAX_FIELD_LENGTH = 65536
 
   def initialize_http_header(initheader) #:nodoc:
     @header = {}
@@ -189,6 +191,12 @@ module Net::HTTPHeader
         warn "net/http: nil HTTP header: #{key}", uplevel: 3 if $VERBOSE
       else
         value = value.strip # raise error for invalid byte sequences
+        if key.to_s.bytesize > MAX_KEY_LENGTH
+          raise ArgumentError, "too long (#{key.bytesize} bytes) header: #{key[0, 30].inspect}..."
+        end
+        if value.to_s.bytesize > MAX_FIELD_LENGTH
+          raise ArgumentError, "header #{key} has too long field value: #{value.bytesize}"
+        end
         if value.count("\r\n") > 0
           raise ArgumentError, "header #{key} has field value #{value.inspect}, this cannot include CR/LF"
         end
diff --git a/version.h b/version.h
index ddce2d0027..766bcdb321 100644
--- a/version.h
+++ b/version.h
@@ -11,7 +11,7 @@
 # define RUBY_VERSION_MINOR RUBY_API_VERSION_MINOR
 #define RUBY_VERSION_TEENY 2
 #define RUBY_RELEASE_DATE RUBY_RELEASE_YEAR_STR"-"RUBY_RELEASE_MONTH_STR"-"RUBY_RELEASE_DAY_STR
-#define RUBY_PATCHLEVEL 136
+#define RUBY_PATCHLEVEL 137
 
 #include "ruby/version.h"
 #include "ruby/internal/abi.h"
-- 
cgit v1.2.3