diff --git a/CVE-2022-25881.patch b/CVE-2022-25881.patch new file mode 100644 index 0000000000000000000000000000000000000000..02866fcbd835937c39de9b4fa89817c2abca743c --- /dev/null +++ b/CVE-2022-25881.patch @@ -0,0 +1,34 @@ +Index: node-v14.21.3/deps/npm/node_modules/http-cache-semantics/node4/index.js +=================================================================== +--- node-v14.21.3.orig/deps/npm/node_modules/http-cache-semantics/node4/index.js ++++ node-v14.21.3/deps/npm/node_modules/http-cache-semantics/node4/index.js +@@ -21,7 +21,7 @@ function parseCacheControl(header) { + + // TODO: When there is more than one value present for a given directive (e.g., two Expires header fields, multiple Cache-Control: max-age directives), + // the directive's value is considered invalid. Caches are encouraged to consider responses that have invalid freshness information to be stale +- var parts = header.trim().split(/\s*,\s*/); // TODO: lame parsing ++ var parts = header.trim().split(/,/); // TODO: lame parsing + for (var _iterator = parts, _isArray = Array.isArray(_iterator), _i = 0, _iterator = _isArray ? _iterator : _iterator[Symbol.iterator]();;) { + var _ref; + +@@ -36,11 +36,11 @@ function parseCacheControl(header) { + + var part = _ref; + +- var _part$split = part.split(/\s*=\s*/, 2), ++ var _part$split = part.split(/=/, 2), + k = _part$split[0], + v = _part$split[1]; + +- cc[k] = v === undefined ? true : v.replace(/^"|"$/g, ''); // TODO: lame unquoting ++ cc[k.trim()] = v === undefined ? true : v.trim().replace(/^"|"$/g, ''); // TODO: lame unquoting + } + + return cc; +@@ -556,4 +556,4 @@ module.exports = function () { + }; + + return CachePolicy; +-}(); +\ No newline at end of file ++}(); diff --git a/CVE-2022-43548-pre-1.patch b/CVE-2022-32212.patch similarity index 85% rename from CVE-2022-43548-pre-1.patch rename to CVE-2022-32212.patch index 34ebc55b7bbeab20081a510a468b1fec27fc2fb7..2a53b1f03c0d49cf6d9a2dd7dd36f94a4545712b 100644 --- a/CVE-2022-43548-pre-1.patch +++ b/CVE-2022-32212.patch @@ -1,21 +1,18 @@ -From 1aa5036c31ac2a9b2a2528af454675ad412f1464 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Tobias=20Nie=C3=9Fen?= -Date: Fri, 27 May 2022 21:18:49 +0000 -Subject: [PATCH] src: fix IPv4 validation in inspector_socket +commit 1aa5036c31ac2a9b2a2528af454675ad412f1464 +Author: Tobias Nießen +Date: Fri May 27 21:18:49 2022 +0000 -Co-authored-by: RafaelGSS - -Reviewed-By: Matteo Collina -Reviewed-By: RafaelGSS -PR-URL: https://github.com/nodejs-private/node-private/pull/320 -CVE-ID: CVE-2022-32212 ---- - src/inspector_socket.cc | 18 +++++-- - test/cctest/test_inspector_socket.cc | 74 ++++++++++++++++++++++++++++ - 2 files changed, 87 insertions(+), 5 deletions(-) + src: fix IPv4 validation in inspector_socket + + Co-authored-by: RafaelGSS + + Reviewed-By: Matteo Collina + Reviewed-By: RafaelGSS + PR-URL: https://github.com/nodejs-private/node-private/pull/320 + CVE-ID: CVE-2022-32212 diff --git a/src/inspector_socket.cc b/src/inspector_socket.cc -index 1650c3fe01de..79b50e6a452d 100644 +index 1650c3fe01..79b50e6a45 100644 --- a/src/inspector_socket.cc +++ b/src/inspector_socket.cc @@ -164,14 +164,22 @@ static std::string TrimPort(const std::string& host) { @@ -47,7 +44,7 @@ index 1650c3fe01de..79b50e6a452d 100644 // Constants for hybi-10 frame format. diff --git a/test/cctest/test_inspector_socket.cc b/test/cctest/test_inspector_socket.cc -index dc8cd962141e..c740d961d9b7 100644 +index dc8cd96214..c740d961d9 100644 --- a/test/cctest/test_inspector_socket.cc +++ b/test/cctest/test_inspector_socket.cc @@ -851,4 +851,78 @@ TEST_F(InspectorSocketTest, HostCheckedForUPGRADE) { diff --git a/CVE-2022-32213-CVE-2022-32214-CVE-2022-32215.patch b/CVE-2022-32213-CVE-2022-32214-CVE-2022-32215.patch new file mode 100644 index 0000000000000000000000000000000000000000..ae7fdaa9fbff46f414efb93a4d07f92157d0719f --- /dev/null +++ b/CVE-2022-32213-CVE-2022-32214-CVE-2022-32215.patch @@ -0,0 +1,3349 @@ +commit da0fda0fe81d372e24c0cb11aec37534985708dd +Author: Paolo Insogna +Date: Wed Jul 6 23:24:45 2022 +0200 + + http: stricter Transfer-Encoding and header separator parsing + + Reviewed-By: Matteo Collina + Reviewed-By: James M Snell + Reviewed-By: Rich Trott + Reviewed-By: Vladimir de Turckheim + PR-URL: #315 + Backport-PR-URL: #327 + CVE-ID: CVE-2022-32215,CVE-2022-32214,CVE-2022-32213 + +Index: node-v12.22.12/deps/llhttp/include/llhttp.h +=================================================================== +--- node-v12.22.12.orig/deps/llhttp/include/llhttp.h ++++ node-v12.22.12/deps/llhttp/include/llhttp.h +@@ -3,7 +3,7 @@ + + #define LLHTTP_VERSION_MAJOR 2 + #define LLHTTP_VERSION_MINOR 1 +-#define LLHTTP_VERSION_PATCH 4 ++#define LLHTTP_VERSION_PATCH 5 + + #ifndef LLHTTP_STRICT_MODE + # define LLHTTP_STRICT_MODE 0 +@@ -58,6 +58,7 @@ enum llhttp_errno { + HPE_OK = 0, + HPE_INTERNAL = 1, + HPE_STRICT = 2, ++ HPE_CR_EXPECTED = 25, + HPE_LF_EXPECTED = 3, + HPE_UNEXPECTED_CONTENT_LENGTH = 4, + HPE_CLOSED_CONNECTION = 5, +@@ -78,7 +79,7 @@ enum llhttp_errno { + HPE_CB_CHUNK_COMPLETE = 20, + HPE_PAUSED = 21, + HPE_PAUSED_UPGRADE = 22, +- HPE_USER = 23 ++ HPE_USER = 24 + }; + typedef enum llhttp_errno llhttp_errno_t; + +@@ -153,6 +154,7 @@ typedef enum llhttp_method llhttp_method + XX(0, OK, OK) \ + XX(1, INTERNAL, INTERNAL) \ + XX(2, STRICT, STRICT) \ ++ XX(25, CR_EXPECTED, CR_EXPECTED) \ + XX(3, LF_EXPECTED, LF_EXPECTED) \ + XX(4, UNEXPECTED_CONTENT_LENGTH, UNEXPECTED_CONTENT_LENGTH) \ + XX(5, CLOSED_CONNECTION, CLOSED_CONNECTION) \ +@@ -173,7 +175,7 @@ typedef enum llhttp_method llhttp_method + XX(20, CB_CHUNK_COMPLETE, CB_CHUNK_COMPLETE) \ + XX(21, PAUSED, PAUSED) \ + XX(22, PAUSED_UPGRADE, PAUSED_UPGRADE) \ +- XX(23, USER, USER) \ ++ XX(24, USER, USER) \ + + + #define HTTP_METHOD_MAP(XX) \ +Index: node-v12.22.12/deps/llhttp/src/llhttp.c +=================================================================== +--- node-v12.22.12.orig/deps/llhttp/src/llhttp.c ++++ node-v12.22.12/deps/llhttp/src/llhttp.c +@@ -325,6 +325,8 @@ enum llparse_state_e { + s_n_llhttp__internal__n_header_value_lws, + s_n_llhttp__internal__n_header_value_almost_done, + s_n_llhttp__internal__n_header_value_lenient, ++ s_n_llhttp__internal__n_error_24, ++ s_n_llhttp__internal__n_header_value_lenient_failed, + s_n_llhttp__internal__n_header_value_otherwise, + s_n_llhttp__internal__n_header_value_connection_token, + s_n_llhttp__internal__n_header_value_connection_ws, +@@ -332,14 +334,16 @@ enum llparse_state_e { + s_n_llhttp__internal__n_header_value_connection_2, + s_n_llhttp__internal__n_header_value_connection_3, + s_n_llhttp__internal__n_header_value_connection, +- s_n_llhttp__internal__n_error_26, + s_n_llhttp__internal__n_error_27, ++ s_n_llhttp__internal__n_error_28, + s_n_llhttp__internal__n_header_value_content_length_ws, + s_n_llhttp__internal__n_header_value_content_length, +- s_n_llhttp__internal__n_header_value_te_chunked_last, ++ s_n_llhttp__internal__n_error_30, ++ s_n_llhttp__internal__n_error_29, + s_n_llhttp__internal__n_header_value_te_token_ows, + s_n_llhttp__internal__n_header_value, + s_n_llhttp__internal__n_header_value_te_token, ++ s_n_llhttp__internal__n_header_value_te_chunked_last, + s_n_llhttp__internal__n_header_value_te_chunked, + s_n_llhttp__internal__n_span_start_llhttp__on_header_value_1, + s_n_llhttp__internal__n_header_value_discard_ws, +@@ -807,6 +811,13 @@ int llhttp__internal__c_or_flags_15( + return 0; + } + ++int llhttp__internal__c_test_flags_7( ++ llhttp__internal_t* state, ++ const unsigned char* p, ++ const unsigned char* endp) { ++ return (state->flags & 8) == 8; ++} ++ + int llhttp__internal__c_or_flags_16( + llhttp__internal_t* state, + const unsigned char* p, +@@ -831,7 +842,7 @@ int llhttp__internal__c_update_header_st + return 0; + } + +-int llhttp__internal__c_or_flags_17( ++int llhttp__internal__c_or_flags_18( + llhttp__internal_t* state, + const unsigned char* p, + const unsigned char* endp) { +@@ -1603,10 +1614,10 @@ static llparse_state_t llhttp__internal_ + } + switch (*p) { + case 10: { +- goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_1; ++ goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_3; + } + case 13: { +- goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_3; ++ goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_4; + } + default: { + p++; +@@ -1616,17 +1627,40 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } ++ case s_n_llhttp__internal__n_error_24: ++ s_n_llhttp__internal__n_error_24: { ++ state->error = 0x19; ++ state->reason = "Missing expected CR after header value"; ++ state->error_pos = (const char*) p; ++ state->_current = (void*) (intptr_t) s_error; ++ return s_error; ++ /* UNREACHABLE */; ++ abort(); ++ } ++ case s_n_llhttp__internal__n_header_value_lenient_failed: ++ s_n_llhttp__internal__n_header_value_lenient_failed: { ++ if (p == endp) { ++ return s_n_llhttp__internal__n_header_value_lenient_failed; ++ } ++ switch (*p) { ++ case 10: { ++ goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_2; ++ } ++ default: { ++ goto s_n_llhttp__internal__n_error_25; ++ } ++ } ++ /* UNREACHABLE */; ++ abort(); ++ } + case s_n_llhttp__internal__n_header_value_otherwise: + s_n_llhttp__internal__n_header_value_otherwise: { + if (p == endp) { + return s_n_llhttp__internal__n_header_value_otherwise; + } + switch (*p) { +- case 10: { +- goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_1; +- } + case 13: { +- goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_2; ++ goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_1; + } + default: { + goto s_n_llhttp__internal__n_invoke_test_flags_5; +@@ -1806,8 +1840,8 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- case s_n_llhttp__internal__n_error_26: +- s_n_llhttp__internal__n_error_26: { ++ case s_n_llhttp__internal__n_error_27: ++ s_n_llhttp__internal__n_error_27: { + state->error = 0xb; + state->reason = "Content-Length overflow"; + state->error_pos = (const char*) p; +@@ -1816,8 +1850,8 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- case s_n_llhttp__internal__n_error_27: +- s_n_llhttp__internal__n_error_27: { ++ case s_n_llhttp__internal__n_error_28: ++ s_n_llhttp__internal__n_error_28: { + state->error = 0xb; + state->reason = "Invalid character in Content-Length"; + state->error_pos = (const char*) p; +@@ -1843,7 +1877,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_header_value_content_length_ws; + } + default: { +- goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_5; ++ goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_6; + } + } + /* UNREACHABLE */; +@@ -1912,26 +1946,23 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- case s_n_llhttp__internal__n_header_value_te_chunked_last: +- s_n_llhttp__internal__n_header_value_te_chunked_last: { +- if (p == endp) { +- return s_n_llhttp__internal__n_header_value_te_chunked_last; +- } +- switch (*p) { +- case 10: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_7; +- } +- case 13: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_7; +- } +- case ' ': { +- p++; +- goto s_n_llhttp__internal__n_header_value_te_chunked_last; +- } +- default: { +- goto s_n_llhttp__internal__n_header_value_te_chunked; +- } +- } ++ case s_n_llhttp__internal__n_error_30: ++ s_n_llhttp__internal__n_error_30: { ++ state->error = 0xf; ++ state->reason = "Invalid `Transfer-Encoding` header value"; ++ state->error_pos = (const char*) p; ++ state->_current = (void*) (intptr_t) s_error; ++ return s_error; ++ /* UNREACHABLE */; ++ abort(); ++ } ++ case s_n_llhttp__internal__n_error_29: ++ s_n_llhttp__internal__n_error_29: { ++ state->error = 0xf; ++ state->reason = "Invalid `Transfer-Encoding` header value"; ++ state->error_pos = (const char*) p; ++ state->_current = (void*) (intptr_t) s_error; ++ return s_error; + /* UNREACHABLE */; + abort(); + } +@@ -2054,6 +2085,32 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } ++ case s_n_llhttp__internal__n_header_value_te_chunked_last: ++ s_n_llhttp__internal__n_header_value_te_chunked_last: { ++ if (p == endp) { ++ return s_n_llhttp__internal__n_header_value_te_chunked_last; ++ } ++ switch (*p) { ++ case 10: { ++ goto s_n_llhttp__internal__n_invoke_update_header_state_7; ++ } ++ case 13: { ++ goto s_n_llhttp__internal__n_invoke_update_header_state_7; ++ } ++ case ' ': { ++ p++; ++ goto s_n_llhttp__internal__n_header_value_te_chunked_last; ++ } ++ case ',': { ++ goto s_n_llhttp__internal__n_invoke_load_type_1; ++ } ++ default: { ++ goto s_n_llhttp__internal__n_header_value_te_token; ++ } ++ } ++ /* UNREACHABLE */; ++ abort(); ++ } + case s_n_llhttp__internal__n_header_value_te_chunked: + s_n_llhttp__internal__n_header_value_te_chunked: { + llparse_match_t match_seq; +@@ -2128,7 +2185,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_span_end_llhttp__on_header_field_2; + } + default: { +- goto s_n_llhttp__internal__n_error_28; ++ goto s_n_llhttp__internal__n_error_31; + } + } + /* UNREACHABLE */; +@@ -2508,7 +2565,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_to_http_09; + } + default: { +- goto s_n_llhttp__internal__n_error_29; ++ goto s_n_llhttp__internal__n_error_32; + } + } + /* UNREACHABLE */; +@@ -2533,7 +2590,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_skip_lf_to_http09_1; + } + default: { +- goto s_n_llhttp__internal__n_error_29; ++ goto s_n_llhttp__internal__n_error_32; + } + } + /* UNREACHABLE */; +@@ -2550,7 +2607,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_header_field_start; + } + default: { +- goto s_n_llhttp__internal__n_error_30; ++ goto s_n_llhttp__internal__n_error_33; + } + } + /* UNREACHABLE */; +@@ -2571,7 +2628,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_req_http_end_1; + } + default: { +- goto s_n_llhttp__internal__n_error_30; ++ goto s_n_llhttp__internal__n_error_33; + } + } + /* UNREACHABLE */; +@@ -2634,7 +2691,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_http_minor; + } + default: { +- goto s_n_llhttp__internal__n_error_31; ++ goto s_n_llhttp__internal__n_error_34; + } + } + /* UNREACHABLE */; +@@ -2651,7 +2708,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_req_http_minor; + } + default: { +- goto s_n_llhttp__internal__n_error_32; ++ goto s_n_llhttp__internal__n_error_35; + } + } + /* UNREACHABLE */; +@@ -2714,7 +2771,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_http_major; + } + default: { +- goto s_n_llhttp__internal__n_error_33; ++ goto s_n_llhttp__internal__n_error_36; + } + } + /* UNREACHABLE */; +@@ -2738,7 +2795,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_req_http_start_1; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_35; ++ goto s_n_llhttp__internal__n_error_38; + } + } + /* UNREACHABLE */; +@@ -2762,7 +2819,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_req_http_start_2; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_35; ++ goto s_n_llhttp__internal__n_error_38; + } + } + /* UNREACHABLE */; +@@ -2787,7 +2844,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_req_http_start_2; + } + default: { +- goto s_n_llhttp__internal__n_error_35; ++ goto s_n_llhttp__internal__n_error_38; + } + } + /* UNREACHABLE */; +@@ -2878,7 +2935,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_fragment; + } + default: { +- goto s_n_llhttp__internal__n_error_36; ++ goto s_n_llhttp__internal__n_error_39; + } + } + /* UNREACHABLE */; +@@ -2939,7 +2996,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_span_end_stub_query_3; + } + default: { +- goto s_n_llhttp__internal__n_error_37; ++ goto s_n_llhttp__internal__n_error_40; + } + } + /* UNREACHABLE */; +@@ -2977,7 +3034,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_query; + } + default: { +- goto s_n_llhttp__internal__n_error_38; ++ goto s_n_llhttp__internal__n_error_41; + } + } + /* UNREACHABLE */; +@@ -3102,10 +3159,10 @@ static llparse_state_t llhttp__internal_ + } + case 8: { + p++; +- goto s_n_llhttp__internal__n_error_39; ++ goto s_n_llhttp__internal__n_error_42; + } + default: { +- goto s_n_llhttp__internal__n_error_40; ++ goto s_n_llhttp__internal__n_error_43; + } + } + /* UNREACHABLE */; +@@ -3164,7 +3221,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_server_with_at; + } + default: { +- goto s_n_llhttp__internal__n_error_41; ++ goto s_n_llhttp__internal__n_error_44; + } + } + /* UNREACHABLE */; +@@ -3181,7 +3238,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_server; + } + default: { +- goto s_n_llhttp__internal__n_error_43; ++ goto s_n_llhttp__internal__n_error_46; + } + } + /* UNREACHABLE */; +@@ -3199,7 +3256,7 @@ static llparse_state_t llhttp__internal_ + } + case 10: { + p++; +- goto s_n_llhttp__internal__n_error_42; ++ goto s_n_llhttp__internal__n_error_45; + } + case 12: { + p++; +@@ -3207,18 +3264,18 @@ static llparse_state_t llhttp__internal_ + } + case 13: { + p++; +- goto s_n_llhttp__internal__n_error_42; ++ goto s_n_llhttp__internal__n_error_45; + } + case ' ': { + p++; +- goto s_n_llhttp__internal__n_error_42; ++ goto s_n_llhttp__internal__n_error_45; + } + case '/': { + p++; + goto s_n_llhttp__internal__n_url_schema_delim_1; + } + default: { +- goto s_n_llhttp__internal__n_error_43; ++ goto s_n_llhttp__internal__n_error_46; + } + } + /* UNREACHABLE */; +@@ -3264,7 +3321,7 @@ static llparse_state_t llhttp__internal_ + } + case 2: { + p++; +- goto s_n_llhttp__internal__n_error_42; ++ goto s_n_llhttp__internal__n_error_45; + } + case 3: { + goto s_n_llhttp__internal__n_span_end_stub_schema; +@@ -3274,7 +3331,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_schema; + } + default: { +- goto s_n_llhttp__internal__n_error_44; ++ goto s_n_llhttp__internal__n_error_47; + } + } + /* UNREACHABLE */; +@@ -3310,7 +3367,7 @@ static llparse_state_t llhttp__internal_ + } + case 2: { + p++; +- goto s_n_llhttp__internal__n_error_42; ++ goto s_n_llhttp__internal__n_error_45; + } + case 3: { + goto s_n_llhttp__internal__n_span_start_stub_path_2; +@@ -3319,7 +3376,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_schema; + } + default: { +- goto s_n_llhttp__internal__n_error_45; ++ goto s_n_llhttp__internal__n_error_48; + } + } + /* UNREACHABLE */; +@@ -3417,7 +3474,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_req_spaces_before_url; + } + default: { +- goto s_n_llhttp__internal__n_error_46; ++ goto s_n_llhttp__internal__n_error_49; + } + } + /* UNREACHABLE */; +@@ -3442,7 +3499,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_1; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -3467,7 +3524,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_2; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -3492,7 +3549,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_4; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -3517,7 +3574,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_6; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -3535,7 +3592,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_method_1; + } + default: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -3556,7 +3613,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_7; + } + default: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -3577,7 +3634,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_5; + } + default: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -3602,7 +3659,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_8; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -3627,7 +3684,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_9; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -3652,7 +3709,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_10; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -3677,7 +3734,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_12; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -3702,7 +3759,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_13; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -3723,7 +3780,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_13; + } + default: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -3748,7 +3805,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_15; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -3773,7 +3830,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_16; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -3798,7 +3855,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_18; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -3823,7 +3880,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_20; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -3841,7 +3898,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_method_1; + } + default: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -3862,7 +3919,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_21; + } + default: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -3883,7 +3940,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_19; + } + default: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -3908,7 +3965,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_22; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -3937,7 +3994,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_22; + } + default: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -3962,7 +4019,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_23; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -3987,7 +4044,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_24; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4012,7 +4069,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_26; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4037,7 +4094,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_27; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4062,7 +4119,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_31; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4087,7 +4144,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_32; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4108,7 +4165,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_32; + } + default: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4125,7 +4182,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_30; + } + default: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4147,7 +4204,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_29; + } + default: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4172,7 +4229,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_34; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4194,7 +4251,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_method_1; + } + default: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4223,7 +4280,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_33; + } + default: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4248,7 +4305,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_37; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4273,7 +4330,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_38; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4294,7 +4351,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_38; + } + default: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4311,7 +4368,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_36; + } + default: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4336,7 +4393,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_40; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4361,7 +4418,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_41; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4386,7 +4443,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_42; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4411,7 +4468,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_42; + } + default: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4436,7 +4493,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_43; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4461,7 +4518,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_46; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4486,7 +4543,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_48; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4511,7 +4568,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_49; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4532,7 +4589,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_49; + } + default: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4557,7 +4614,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_50; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4582,7 +4639,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_50; + } + default: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4599,7 +4656,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_45; + } + default: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4672,7 +4729,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_44; + } + default: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -4689,7 +4746,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_header_field_start; + } + default: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -4764,7 +4821,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_res_status_start; + } + default: { +- goto s_n_llhttp__internal__n_error_49; ++ goto s_n_llhttp__internal__n_error_52; + } + } + /* UNREACHABLE */; +@@ -4844,7 +4901,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_update_status_code; + } + default: { +- goto s_n_llhttp__internal__n_error_50; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -4907,7 +4964,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_http_minor_1; + } + default: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_54; + } + } + /* UNREACHABLE */; +@@ -4924,7 +4981,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_res_http_minor; + } + default: { +- goto s_n_llhttp__internal__n_error_52; ++ goto s_n_llhttp__internal__n_error_55; + } + } + /* UNREACHABLE */; +@@ -4987,7 +5044,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_http_major_1; + } + default: { +- goto s_n_llhttp__internal__n_error_53; ++ goto s_n_llhttp__internal__n_error_56; + } + } + /* UNREACHABLE */; +@@ -5011,7 +5068,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_res; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_56; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -5036,7 +5093,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_req_or_res_method_2; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_54; ++ goto s_n_llhttp__internal__n_error_57; + } + } + /* UNREACHABLE */; +@@ -5060,7 +5117,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_req_or_res_method_3; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_54; ++ goto s_n_llhttp__internal__n_error_57; + } + } + /* UNREACHABLE */; +@@ -5081,7 +5138,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_req_or_res_method_3; + } + default: { +- goto s_n_llhttp__internal__n_error_54; ++ goto s_n_llhttp__internal__n_error_57; + } + } + /* UNREACHABLE */; +@@ -5098,7 +5155,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_req_or_res_method_1; + } + default: { +- goto s_n_llhttp__internal__n_error_54; ++ goto s_n_llhttp__internal__n_error_57; + } + } + /* UNREACHABLE */; +@@ -5167,7 +5224,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_42: { ++ s_n_llhttp__internal__n_error_45: { + state->error = 0x7; + state->reason = "Invalid characters in url"; + state->error_pos = (const char*) p; +@@ -5830,6 +5887,24 @@ static llparse_state_t llhttp__internal_ + err = llhttp__on_header_value(state, start, p); + if (err != 0) { + state->error = err; ++ state->error_pos = (const char*) (p + 1); ++ state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_header_value_almost_done; ++ return s_error; ++ } ++ p++; ++ goto s_n_llhttp__internal__n_header_value_almost_done; ++ /* UNREACHABLE */; ++ abort(); ++ } ++ s_n_llhttp__internal__n_span_end_llhttp__on_header_value_3: { ++ const unsigned char* start; ++ int err; ++ ++ start = state->_span_pos0; ++ state->_span_pos0 = NULL; ++ err = llhttp__on_header_value(state, start, p); ++ if (err != 0) { ++ state->error = err; + state->error_pos = (const char*) p; + state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_header_value_almost_done; + return s_error; +@@ -5838,7 +5913,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_span_end_llhttp__on_header_value_2: { ++ s_n_llhttp__internal__n_span_end_llhttp__on_header_value_4: { + const unsigned char* start; + int err; + +@@ -5856,7 +5931,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_span_end_llhttp__on_header_value_3: { ++ s_n_llhttp__internal__n_span_end_llhttp__on_header_value_2: { + const unsigned char* start; + int err; + +@@ -5866,15 +5941,15 @@ static llparse_state_t llhttp__internal_ + if (err != 0) { + state->error = err; + state->error_pos = (const char*) (p + 1); +- state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_header_value_almost_done; ++ state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_24; + return s_error; + } + p++; +- goto s_n_llhttp__internal__n_header_value_almost_done; ++ goto s_n_llhttp__internal__n_error_24; + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_24: { ++ s_n_llhttp__internal__n_error_25: { + state->error = 0xa; + state->reason = "Invalid header value char"; + state->error_pos = (const char*) p; +@@ -5888,7 +5963,7 @@ static llparse_state_t llhttp__internal_ + case 1: + goto s_n_llhttp__internal__n_header_value_lenient; + default: +- goto s_n_llhttp__internal__n_error_24; ++ goto s_n_llhttp__internal__n_header_value_lenient_failed; + } + /* UNREACHABLE */; + abort(); +@@ -5981,7 +6056,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_span_end_llhttp__on_header_value_4: { ++ s_n_llhttp__internal__n_span_end_llhttp__on_header_value_5: { + const unsigned char* start; + int err; + +@@ -5991,17 +6066,17 @@ static llparse_state_t llhttp__internal_ + if (err != 0) { + state->error = err; + state->error_pos = (const char*) p; +- state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_26; ++ state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_27; + return s_error; + } +- goto s_n_llhttp__internal__n_error_26; ++ goto s_n_llhttp__internal__n_error_27; + /* UNREACHABLE */; + abort(); + } + s_n_llhttp__internal__n_invoke_mul_add_content_length_1: { + switch (llhttp__internal__c_mul_add_content_length_1(state, p, endp, match)) { + case 1: +- goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_4; ++ goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_5; + default: + goto s_n_llhttp__internal__n_header_value_content_length; + } +@@ -6016,7 +6091,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_span_end_llhttp__on_header_value_5: { ++ s_n_llhttp__internal__n_span_end_llhttp__on_header_value_6: { + const unsigned char* start; + int err; + +@@ -6026,14 +6101,14 @@ static llparse_state_t llhttp__internal_ + if (err != 0) { + state->error = err; + state->error_pos = (const char*) p; +- state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_27; ++ state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_28; + return s_error; + } +- goto s_n_llhttp__internal__n_error_27; ++ goto s_n_llhttp__internal__n_error_28; + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_25: { ++ s_n_llhttp__internal__n_error_26: { + state->error = 0x4; + state->reason = "Duplicate Content-Length"; + state->error_pos = (const char*) p; +@@ -6047,8 +6122,26 @@ static llparse_state_t llhttp__internal_ + case 0: + goto s_n_llhttp__internal__n_header_value_content_length; + default: +- goto s_n_llhttp__internal__n_error_25; ++ goto s_n_llhttp__internal__n_error_26; ++ } ++ /* UNREACHABLE */; ++ abort(); ++ } ++ s_n_llhttp__internal__n_span_end_llhttp__on_header_value_8: { ++ const unsigned char* start; ++ int err; ++ ++ start = state->_span_pos0; ++ state->_span_pos0 = NULL; ++ err = llhttp__on_header_value(state, start, p); ++ if (err != 0) { ++ state->error = err; ++ state->error_pos = (const char*) (p + 1); ++ state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_30; ++ return s_error; + } ++ p++; ++ goto s_n_llhttp__internal__n_error_30; + /* UNREACHABLE */; + abort(); + } +@@ -6060,6 +6153,44 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } ++ s_n_llhttp__internal__n_span_end_llhttp__on_header_value_7: { ++ const unsigned char* start; ++ int err; ++ ++ start = state->_span_pos0; ++ state->_span_pos0 = NULL; ++ err = llhttp__on_header_value(state, start, p); ++ if (err != 0) { ++ state->error = err; ++ state->error_pos = (const char*) (p + 1); ++ state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_29; ++ return s_error; ++ } ++ p++; ++ goto s_n_llhttp__internal__n_error_29; ++ /* UNREACHABLE */; ++ abort(); ++ } ++ s_n_llhttp__internal__n_invoke_test_flags_8: { ++ switch (llhttp__internal__c_test_flags_2(state, p, endp)) { ++ case 0: ++ goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_7; ++ default: ++ goto s_n_llhttp__internal__n_header_value_te_chunked; ++ } ++ /* UNREACHABLE */; ++ abort(); ++ } ++ s_n_llhttp__internal__n_invoke_load_type_1: { ++ switch (llhttp__internal__c_load_type(state, p, endp)) { ++ case 1: ++ goto s_n_llhttp__internal__n_invoke_test_flags_8; ++ default: ++ goto s_n_llhttp__internal__n_header_value_te_chunked; ++ } ++ /* UNREACHABLE */; ++ abort(); ++ } + s_n_llhttp__internal__n_invoke_update_header_state_8: { + switch (llhttp__internal__c_update_header_state_4(state, p, endp)) { + default: +@@ -6076,6 +6207,34 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } ++ s_n_llhttp__internal__n_invoke_or_flags_17: { ++ switch (llhttp__internal__c_or_flags_16(state, p, endp)) { ++ default: ++ goto s_n_llhttp__internal__n_invoke_and_flags; ++ } ++ /* UNREACHABLE */; ++ abort(); ++ } ++ s_n_llhttp__internal__n_invoke_test_flags_9: { ++ switch (llhttp__internal__c_test_flags_2(state, p, endp)) { ++ case 0: ++ goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_8; ++ default: ++ goto s_n_llhttp__internal__n_invoke_or_flags_17; ++ } ++ /* UNREACHABLE */; ++ abort(); ++ } ++ s_n_llhttp__internal__n_invoke_load_type_2: { ++ switch (llhttp__internal__c_load_type(state, p, endp)) { ++ case 1: ++ goto s_n_llhttp__internal__n_invoke_test_flags_9; ++ default: ++ goto s_n_llhttp__internal__n_invoke_or_flags_17; ++ } ++ /* UNREACHABLE */; ++ abort(); ++ } + s_n_llhttp__internal__n_invoke_or_flags_16: { + switch (llhttp__internal__c_or_flags_16(state, p, endp)) { + default: +@@ -6084,8 +6243,18 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_or_flags_17: { +- switch (llhttp__internal__c_or_flags_17(state, p, endp)) { ++ s_n_llhttp__internal__n_invoke_test_flags_7: { ++ switch (llhttp__internal__c_test_flags_7(state, p, endp)) { ++ case 1: ++ goto s_n_llhttp__internal__n_invoke_load_type_2; ++ default: ++ goto s_n_llhttp__internal__n_invoke_or_flags_16; ++ } ++ /* UNREACHABLE */; ++ abort(); ++ } ++ s_n_llhttp__internal__n_invoke_or_flags_18: { ++ switch (llhttp__internal__c_or_flags_18(state, p, endp)) { + default: + goto s_n_llhttp__internal__n_invoke_update_header_state_8; + } +@@ -6099,9 +6268,9 @@ static llparse_state_t llhttp__internal_ + case 2: + goto s_n_llhttp__internal__n_invoke_test_flags_6; + case 3: +- goto s_n_llhttp__internal__n_invoke_or_flags_16; ++ goto s_n_llhttp__internal__n_invoke_test_flags_7; + case 4: +- goto s_n_llhttp__internal__n_invoke_or_flags_17; ++ goto s_n_llhttp__internal__n_invoke_or_flags_18; + default: + goto s_n_llhttp__internal__n_header_value; + } +@@ -6144,7 +6313,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_28: { ++ s_n_llhttp__internal__n_error_31: { + state->error = 0xa; + state->reason = "Invalid header token"; + state->error_pos = (const char*) p; +@@ -6210,7 +6379,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_29: { ++ s_n_llhttp__internal__n_error_32: { + state->error = 0x7; + state->reason = "Expected CRLF"; + state->error_pos = (const char*) p; +@@ -6236,7 +6405,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_30: { ++ s_n_llhttp__internal__n_error_33: { + state->error = 0x9; + state->reason = "Expected CRLF after version"; + state->error_pos = (const char*) p; +@@ -6253,7 +6422,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_31: { ++ s_n_llhttp__internal__n_error_34: { + state->error = 0x9; + state->reason = "Invalid minor version"; + state->error_pos = (const char*) p; +@@ -6262,7 +6431,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_32: { ++ s_n_llhttp__internal__n_error_35: { + state->error = 0x9; + state->reason = "Expected dot"; + state->error_pos = (const char*) p; +@@ -6279,7 +6448,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_33: { ++ s_n_llhttp__internal__n_error_36: { + state->error = 0x9; + state->reason = "Invalid major version"; + state->error_pos = (const char*) p; +@@ -6288,7 +6457,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_35: { ++ s_n_llhttp__internal__n_error_38: { + state->error = 0x8; + state->reason = "Expected HTTP/"; + state->error_pos = (const char*) p; +@@ -6297,7 +6466,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_34: { ++ s_n_llhttp__internal__n_error_37: { + state->error = 0x8; + state->reason = "Expected SOURCE method for ICE/x.x request"; + state->error_pos = (const char*) p; +@@ -6309,7 +6478,7 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_is_equal_method_1: { + switch (llhttp__internal__c_is_equal_method_1(state, p, endp)) { + case 0: +- goto s_n_llhttp__internal__n_error_34; ++ goto s_n_llhttp__internal__n_error_37; + default: + goto s_n_llhttp__internal__n_req_http_major; + } +@@ -6384,7 +6553,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_36: { ++ s_n_llhttp__internal__n_error_39: { + state->error = 0x7; + state->reason = "Invalid char in url fragment start"; + state->error_pos = (const char*) p; +@@ -6444,7 +6613,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_37: { ++ s_n_llhttp__internal__n_error_40: { + state->error = 0x7; + state->reason = "Invalid char in url query"; + state->error_pos = (const char*) p; +@@ -6453,7 +6622,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_38: { ++ s_n_llhttp__internal__n_error_41: { + state->error = 0x7; + state->reason = "Invalid char in url path"; + state->error_pos = (const char*) p; +@@ -6564,7 +6733,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_39: { ++ s_n_llhttp__internal__n_error_42: { + state->error = 0x7; + state->reason = "Double @ in url"; + state->error_pos = (const char*) p; +@@ -6573,7 +6742,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_40: { ++ s_n_llhttp__internal__n_error_43: { + state->error = 0x7; + state->reason = "Unexpected char in url server"; + state->error_pos = (const char*) p; +@@ -6582,7 +6751,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_41: { ++ s_n_llhttp__internal__n_error_44: { + state->error = 0x7; + state->reason = "Unexpected char in url server"; + state->error_pos = (const char*) p; +@@ -6591,7 +6760,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_43: { ++ s_n_llhttp__internal__n_error_46: { + state->error = 0x7; + state->reason = "Unexpected char in url schema"; + state->error_pos = (const char*) p; +@@ -6600,7 +6769,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_44: { ++ s_n_llhttp__internal__n_error_47: { + state->error = 0x7; + state->reason = "Unexpected char in url schema"; + state->error_pos = (const char*) p; +@@ -6609,7 +6778,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_45: { ++ s_n_llhttp__internal__n_error_48: { + state->error = 0x7; + state->reason = "Unexpected start char in url"; + state->error_pos = (const char*) p; +@@ -6628,7 +6797,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_46: { ++ s_n_llhttp__internal__n_error_49: { + state->error = 0x6; + state->reason = "Expected space after method"; + state->error_pos = (const char*) p; +@@ -6645,7 +6814,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_55: { ++ s_n_llhttp__internal__n_error_58: { + state->error = 0x6; + state->reason = "Invalid method encountered"; + state->error_pos = (const char*) p; +@@ -6654,7 +6823,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_47: { ++ s_n_llhttp__internal__n_error_50: { + state->error = 0xd; + state->reason = "Response overflow"; + state->error_pos = (const char*) p; +@@ -6666,14 +6835,14 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_mul_add_status_code: { + switch (llhttp__internal__c_mul_add_status_code(state, p, endp, match)) { + case 1: +- goto s_n_llhttp__internal__n_error_47; ++ goto s_n_llhttp__internal__n_error_50; + default: + goto s_n_llhttp__internal__n_res_status_code; + } + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_48: { ++ s_n_llhttp__internal__n_error_51: { + state->error = 0x2; + state->reason = "Expected LF after CR"; + state->error_pos = (const char*) p; +@@ -6718,7 +6887,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_49: { ++ s_n_llhttp__internal__n_error_52: { + state->error = 0xd; + state->reason = "Invalid response status"; + state->error_pos = (const char*) p; +@@ -6735,7 +6904,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_50: { ++ s_n_llhttp__internal__n_error_53: { + state->error = 0x9; + state->reason = "Expected space after version"; + state->error_pos = (const char*) p; +@@ -6752,7 +6921,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_51: { ++ s_n_llhttp__internal__n_error_54: { + state->error = 0x9; + state->reason = "Invalid minor version"; + state->error_pos = (const char*) p; +@@ -6761,7 +6930,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_52: { ++ s_n_llhttp__internal__n_error_55: { + state->error = 0x9; + state->reason = "Expected dot"; + state->error_pos = (const char*) p; +@@ -6778,7 +6947,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_53: { ++ s_n_llhttp__internal__n_error_56: { + state->error = 0x9; + state->reason = "Invalid major version"; + state->error_pos = (const char*) p; +@@ -6787,7 +6956,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_56: { ++ s_n_llhttp__internal__n_error_59: { + state->error = 0x8; + state->reason = "Expected HTTP/"; + state->error_pos = (const char*) p; +@@ -6812,7 +6981,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_54: { ++ s_n_llhttp__internal__n_error_57: { + state->error = 0x8; + state->reason = "Invalid word encountered"; + state->error_pos = (const char*) p; +@@ -7244,6 +7413,8 @@ enum llparse_state_e { + s_n_llhttp__internal__n_header_value_lws, + s_n_llhttp__internal__n_header_value_almost_done, + s_n_llhttp__internal__n_header_value_lenient, ++ s_n_llhttp__internal__n_error_18, ++ s_n_llhttp__internal__n_header_value_lenient_failed, + s_n_llhttp__internal__n_header_value_otherwise, + s_n_llhttp__internal__n_header_value_connection_token, + s_n_llhttp__internal__n_header_value_connection_ws, +@@ -7251,14 +7422,16 @@ enum llparse_state_e { + s_n_llhttp__internal__n_header_value_connection_2, + s_n_llhttp__internal__n_header_value_connection_3, + s_n_llhttp__internal__n_header_value_connection, +- s_n_llhttp__internal__n_error_20, + s_n_llhttp__internal__n_error_21, ++ s_n_llhttp__internal__n_error_22, + s_n_llhttp__internal__n_header_value_content_length_ws, + s_n_llhttp__internal__n_header_value_content_length, +- s_n_llhttp__internal__n_header_value_te_chunked_last, ++ s_n_llhttp__internal__n_error_24, ++ s_n_llhttp__internal__n_error_23, + s_n_llhttp__internal__n_header_value_te_token_ows, + s_n_llhttp__internal__n_header_value, + s_n_llhttp__internal__n_header_value_te_token, ++ s_n_llhttp__internal__n_header_value_te_chunked_last, + s_n_llhttp__internal__n_header_value_te_chunked, + s_n_llhttp__internal__n_span_start_llhttp__on_header_value_1, + s_n_llhttp__internal__n_header_value_discard_ws, +@@ -7721,6 +7894,13 @@ int llhttp__internal__c_or_flags_15( + return 0; + } + ++int llhttp__internal__c_test_flags_7( ++ llhttp__internal_t* state, ++ const unsigned char* p, ++ const unsigned char* endp) { ++ return (state->flags & 8) == 8; ++} ++ + int llhttp__internal__c_or_flags_16( + llhttp__internal_t* state, + const unsigned char* p, +@@ -7745,7 +7925,7 @@ int llhttp__internal__c_update_header_st + return 0; + } + +-int llhttp__internal__c_or_flags_17( ++int llhttp__internal__c_or_flags_18( + llhttp__internal_t* state, + const unsigned char* p, + const unsigned char* endp) { +@@ -8468,10 +8648,10 @@ static llparse_state_t llhttp__internal_ + } + switch (*p) { + case 10: { +- goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_1; ++ goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_3; + } + case 13: { +- goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_3; ++ goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_4; + } + default: { + p++; +@@ -8481,17 +8661,40 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } ++ case s_n_llhttp__internal__n_error_18: ++ s_n_llhttp__internal__n_error_18: { ++ state->error = 0x19; ++ state->reason = "Missing expected CR after header value"; ++ state->error_pos = (const char*) p; ++ state->_current = (void*) (intptr_t) s_error; ++ return s_error; ++ /* UNREACHABLE */; ++ abort(); ++ } ++ case s_n_llhttp__internal__n_header_value_lenient_failed: ++ s_n_llhttp__internal__n_header_value_lenient_failed: { ++ if (p == endp) { ++ return s_n_llhttp__internal__n_header_value_lenient_failed; ++ } ++ switch (*p) { ++ case 10: { ++ goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_2; ++ } ++ default: { ++ goto s_n_llhttp__internal__n_error_19; ++ } ++ } ++ /* UNREACHABLE */; ++ abort(); ++ } + case s_n_llhttp__internal__n_header_value_otherwise: + s_n_llhttp__internal__n_header_value_otherwise: { + if (p == endp) { + return s_n_llhttp__internal__n_header_value_otherwise; + } + switch (*p) { +- case 10: { +- goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_1; +- } + case 13: { +- goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_2; ++ goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_1; + } + default: { + goto s_n_llhttp__internal__n_invoke_test_flags_5; +@@ -8671,8 +8874,8 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- case s_n_llhttp__internal__n_error_20: +- s_n_llhttp__internal__n_error_20: { ++ case s_n_llhttp__internal__n_error_21: ++ s_n_llhttp__internal__n_error_21: { + state->error = 0xb; + state->reason = "Content-Length overflow"; + state->error_pos = (const char*) p; +@@ -8681,8 +8884,8 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- case s_n_llhttp__internal__n_error_21: +- s_n_llhttp__internal__n_error_21: { ++ case s_n_llhttp__internal__n_error_22: ++ s_n_llhttp__internal__n_error_22: { + state->error = 0xb; + state->reason = "Invalid character in Content-Length"; + state->error_pos = (const char*) p; +@@ -8708,7 +8911,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_header_value_content_length_ws; + } + default: { +- goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_5; ++ goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_6; + } + } + /* UNREACHABLE */; +@@ -8777,26 +8980,23 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- case s_n_llhttp__internal__n_header_value_te_chunked_last: +- s_n_llhttp__internal__n_header_value_te_chunked_last: { +- if (p == endp) { +- return s_n_llhttp__internal__n_header_value_te_chunked_last; +- } +- switch (*p) { +- case 10: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_7; +- } +- case 13: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_7; +- } +- case ' ': { +- p++; +- goto s_n_llhttp__internal__n_header_value_te_chunked_last; +- } +- default: { +- goto s_n_llhttp__internal__n_header_value_te_chunked; +- } +- } ++ case s_n_llhttp__internal__n_error_24: ++ s_n_llhttp__internal__n_error_24: { ++ state->error = 0xf; ++ state->reason = "Invalid `Transfer-Encoding` header value"; ++ state->error_pos = (const char*) p; ++ state->_current = (void*) (intptr_t) s_error; ++ return s_error; ++ /* UNREACHABLE */; ++ abort(); ++ } ++ case s_n_llhttp__internal__n_error_23: ++ s_n_llhttp__internal__n_error_23: { ++ state->error = 0xf; ++ state->reason = "Invalid `Transfer-Encoding` header value"; ++ state->error_pos = (const char*) p; ++ state->_current = (void*) (intptr_t) s_error; ++ return s_error; + /* UNREACHABLE */; + abort(); + } +@@ -8919,6 +9119,32 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } ++ case s_n_llhttp__internal__n_header_value_te_chunked_last: ++ s_n_llhttp__internal__n_header_value_te_chunked_last: { ++ if (p == endp) { ++ return s_n_llhttp__internal__n_header_value_te_chunked_last; ++ } ++ switch (*p) { ++ case 10: { ++ goto s_n_llhttp__internal__n_invoke_update_header_state_7; ++ } ++ case 13: { ++ goto s_n_llhttp__internal__n_invoke_update_header_state_7; ++ } ++ case ' ': { ++ p++; ++ goto s_n_llhttp__internal__n_header_value_te_chunked_last; ++ } ++ case ',': { ++ goto s_n_llhttp__internal__n_invoke_load_type_1; ++ } ++ default: { ++ goto s_n_llhttp__internal__n_header_value_te_token; ++ } ++ } ++ /* UNREACHABLE */; ++ abort(); ++ } + case s_n_llhttp__internal__n_header_value_te_chunked: + s_n_llhttp__internal__n_header_value_te_chunked: { + llparse_match_t match_seq; +@@ -8993,7 +9219,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_span_end_llhttp__on_header_field_2; + } + default: { +- goto s_n_llhttp__internal__n_error_22; ++ goto s_n_llhttp__internal__n_error_25; + } + } + /* UNREACHABLE */; +@@ -9347,7 +9573,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_url_skip_lf_to_http09; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_23; ++ goto s_n_llhttp__internal__n_error_26; + } + } + /* UNREACHABLE */; +@@ -9364,7 +9590,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_header_field_start; + } + default: { +- goto s_n_llhttp__internal__n_error_24; ++ goto s_n_llhttp__internal__n_error_27; + } + } + /* UNREACHABLE */; +@@ -9385,7 +9611,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_req_http_end_1; + } + default: { +- goto s_n_llhttp__internal__n_error_24; ++ goto s_n_llhttp__internal__n_error_27; + } + } + /* UNREACHABLE */; +@@ -9448,7 +9674,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_http_minor; + } + default: { +- goto s_n_llhttp__internal__n_error_25; ++ goto s_n_llhttp__internal__n_error_28; + } + } + /* UNREACHABLE */; +@@ -9465,7 +9691,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_req_http_minor; + } + default: { +- goto s_n_llhttp__internal__n_error_26; ++ goto s_n_llhttp__internal__n_error_29; + } + } + /* UNREACHABLE */; +@@ -9528,7 +9754,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_http_major; + } + default: { +- goto s_n_llhttp__internal__n_error_27; ++ goto s_n_llhttp__internal__n_error_30; + } + } + /* UNREACHABLE */; +@@ -9552,7 +9778,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_req_http_start_1; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_29; ++ goto s_n_llhttp__internal__n_error_32; + } + } + /* UNREACHABLE */; +@@ -9576,7 +9802,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_req_http_start_2; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_29; ++ goto s_n_llhttp__internal__n_error_32; + } + } + /* UNREACHABLE */; +@@ -9601,7 +9827,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_req_http_start_2; + } + default: { +- goto s_n_llhttp__internal__n_error_29; ++ goto s_n_llhttp__internal__n_error_32; + } + } + /* UNREACHABLE */; +@@ -9655,7 +9881,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_span_end_llhttp__on_url_8; + } + default: { +- goto s_n_llhttp__internal__n_error_30; ++ goto s_n_llhttp__internal__n_error_33; + } + } + /* UNREACHABLE */; +@@ -9712,7 +9938,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_span_end_stub_query_3; + } + default: { +- goto s_n_llhttp__internal__n_error_31; ++ goto s_n_llhttp__internal__n_error_34; + } + } + /* UNREACHABLE */; +@@ -9742,7 +9968,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_query; + } + default: { +- goto s_n_llhttp__internal__n_error_32; ++ goto s_n_llhttp__internal__n_error_35; + } + } + /* UNREACHABLE */; +@@ -9883,10 +10109,10 @@ static llparse_state_t llhttp__internal_ + } + case 7: { + p++; +- goto s_n_llhttp__internal__n_error_33; ++ goto s_n_llhttp__internal__n_error_36; + } + default: { +- goto s_n_llhttp__internal__n_error_34; ++ goto s_n_llhttp__internal__n_error_37; + } + } + /* UNREACHABLE */; +@@ -9941,7 +10167,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_server_with_at; + } + default: { +- goto s_n_llhttp__internal__n_error_35; ++ goto s_n_llhttp__internal__n_error_38; + } + } + /* UNREACHABLE */; +@@ -9958,7 +10184,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_server; + } + default: { +- goto s_n_llhttp__internal__n_error_37; ++ goto s_n_llhttp__internal__n_error_40; + } + } + /* UNREACHABLE */; +@@ -9972,22 +10198,22 @@ static llparse_state_t llhttp__internal_ + switch (*p) { + case 10: { + p++; +- goto s_n_llhttp__internal__n_error_36; ++ goto s_n_llhttp__internal__n_error_39; + } + case 13: { + p++; +- goto s_n_llhttp__internal__n_error_36; ++ goto s_n_llhttp__internal__n_error_39; + } + case ' ': { + p++; +- goto s_n_llhttp__internal__n_error_36; ++ goto s_n_llhttp__internal__n_error_39; + } + case '/': { + p++; + goto s_n_llhttp__internal__n_url_schema_delim_1; + } + default: { +- goto s_n_llhttp__internal__n_error_37; ++ goto s_n_llhttp__internal__n_error_40; + } + } + /* UNREACHABLE */; +@@ -10029,7 +10255,7 @@ static llparse_state_t llhttp__internal_ + switch (lookup_table[(uint8_t) *p]) { + case 1: { + p++; +- goto s_n_llhttp__internal__n_error_36; ++ goto s_n_llhttp__internal__n_error_39; + } + case 2: { + goto s_n_llhttp__internal__n_span_end_stub_schema; +@@ -10039,7 +10265,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_schema; + } + default: { +- goto s_n_llhttp__internal__n_error_38; ++ goto s_n_llhttp__internal__n_error_41; + } + } + /* UNREACHABLE */; +@@ -10071,7 +10297,7 @@ static llparse_state_t llhttp__internal_ + switch (lookup_table[(uint8_t) *p]) { + case 1: { + p++; +- goto s_n_llhttp__internal__n_error_36; ++ goto s_n_llhttp__internal__n_error_39; + } + case 2: { + goto s_n_llhttp__internal__n_span_start_stub_path_2; +@@ -10080,7 +10306,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_schema; + } + default: { +- goto s_n_llhttp__internal__n_error_39; ++ goto s_n_llhttp__internal__n_error_42; + } + } + /* UNREACHABLE */; +@@ -10136,7 +10362,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_req_spaces_before_url; + } + default: { +- goto s_n_llhttp__internal__n_error_40; ++ goto s_n_llhttp__internal__n_error_43; + } + } + /* UNREACHABLE */; +@@ -10161,7 +10387,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_1; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10186,7 +10412,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_2; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10211,7 +10437,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_4; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10236,7 +10462,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_6; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10254,7 +10480,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_method_1; + } + default: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10275,7 +10501,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_7; + } + default: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10296,7 +10522,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_5; + } + default: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10321,7 +10547,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_8; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10346,7 +10572,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_9; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10371,7 +10597,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_10; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10396,7 +10622,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_12; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10421,7 +10647,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_13; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10442,7 +10668,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_13; + } + default: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10467,7 +10693,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_15; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10492,7 +10718,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_16; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10517,7 +10743,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_18; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10542,7 +10768,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_20; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10560,7 +10786,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_method_1; + } + default: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10581,7 +10807,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_21; + } + default: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10602,7 +10828,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_19; + } + default: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10627,7 +10853,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_22; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10656,7 +10882,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_22; + } + default: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10681,7 +10907,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_23; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10706,7 +10932,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_24; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10731,7 +10957,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_26; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10756,7 +10982,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_27; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10781,7 +11007,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_31; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10806,7 +11032,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_32; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10827,7 +11053,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_32; + } + default: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10844,7 +11070,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_30; + } + default: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10866,7 +11092,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_29; + } + default: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10891,7 +11117,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_34; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10913,7 +11139,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_method_1; + } + default: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10942,7 +11168,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_33; + } + default: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10967,7 +11193,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_37; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -10992,7 +11218,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_38; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -11013,7 +11239,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_38; + } + default: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -11030,7 +11256,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_36; + } + default: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -11055,7 +11281,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_40; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -11080,7 +11306,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_41; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -11105,7 +11331,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_42; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -11130,7 +11356,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_42; + } + default: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -11155,7 +11381,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_43; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -11180,7 +11406,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_46; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -11205,7 +11431,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_48; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -11230,7 +11456,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_49; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -11251,7 +11477,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_49; + } + default: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -11276,7 +11502,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_50; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -11301,7 +11527,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_50; + } + default: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -11318,7 +11544,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_45; + } + default: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -11391,7 +11617,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_44; + } + default: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -11476,7 +11702,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_res_status_start; + } + default: { +- goto s_n_llhttp__internal__n_error_42; ++ goto s_n_llhttp__internal__n_error_45; + } + } + /* UNREACHABLE */; +@@ -11556,7 +11782,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_update_status_code; + } + default: { +- goto s_n_llhttp__internal__n_error_43; ++ goto s_n_llhttp__internal__n_error_46; + } + } + /* UNREACHABLE */; +@@ -11619,7 +11845,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_http_minor_1; + } + default: { +- goto s_n_llhttp__internal__n_error_44; ++ goto s_n_llhttp__internal__n_error_47; + } + } + /* UNREACHABLE */; +@@ -11636,7 +11862,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_res_http_minor; + } + default: { +- goto s_n_llhttp__internal__n_error_45; ++ goto s_n_llhttp__internal__n_error_48; + } + } + /* UNREACHABLE */; +@@ -11699,7 +11925,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_http_major_1; + } + default: { +- goto s_n_llhttp__internal__n_error_46; ++ goto s_n_llhttp__internal__n_error_49; + } + } + /* UNREACHABLE */; +@@ -11723,7 +11949,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_res; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_49; ++ goto s_n_llhttp__internal__n_error_52; + } + } + /* UNREACHABLE */; +@@ -11748,7 +11974,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_req_or_res_method_2; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_47; ++ goto s_n_llhttp__internal__n_error_50; + } + } + /* UNREACHABLE */; +@@ -11772,7 +11998,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_req_or_res_method_3; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_47; ++ goto s_n_llhttp__internal__n_error_50; + } + } + /* UNREACHABLE */; +@@ -11793,7 +12019,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_req_or_res_method_3; + } + default: { +- goto s_n_llhttp__internal__n_error_47; ++ goto s_n_llhttp__internal__n_error_50; + } + } + /* UNREACHABLE */; +@@ -11810,7 +12036,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_req_or_res_method_1; + } + default: { +- goto s_n_llhttp__internal__n_error_47; ++ goto s_n_llhttp__internal__n_error_50; + } + } + /* UNREACHABLE */; +@@ -11870,7 +12096,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */ + abort(); + } +- s_n_llhttp__internal__n_error_36: { ++ s_n_llhttp__internal__n_error_39: { + state->error = 0x7; + state->reason = "Invalid characters in url"; + state->error_pos = (const char*) p; +@@ -12480,6 +12706,24 @@ static llparse_state_t llhttp__internal_ + err = llhttp__on_header_value(state, start, p); + if (err != 0) { + state->error = err; ++ state->error_pos = (const char*) (p + 1); ++ state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_header_value_almost_done; ++ return s_error; ++ } ++ p++; ++ goto s_n_llhttp__internal__n_header_value_almost_done; ++ /* UNREACHABLE */; ++ abort(); ++ } ++ s_n_llhttp__internal__n_span_end_llhttp__on_header_value_3: { ++ const unsigned char* start; ++ int err; ++ ++ start = state->_span_pos0; ++ state->_span_pos0 = NULL; ++ err = llhttp__on_header_value(state, start, p); ++ if (err != 0) { ++ state->error = err; + state->error_pos = (const char*) p; + state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_header_value_almost_done; + return s_error; +@@ -12488,7 +12732,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_span_end_llhttp__on_header_value_2: { ++ s_n_llhttp__internal__n_span_end_llhttp__on_header_value_4: { + const unsigned char* start; + int err; + +@@ -12506,7 +12750,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_span_end_llhttp__on_header_value_3: { ++ s_n_llhttp__internal__n_span_end_llhttp__on_header_value_2: { + const unsigned char* start; + int err; + +@@ -12516,15 +12760,15 @@ static llparse_state_t llhttp__internal_ + if (err != 0) { + state->error = err; + state->error_pos = (const char*) (p + 1); +- state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_header_value_almost_done; ++ state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_18; + return s_error; + } + p++; +- goto s_n_llhttp__internal__n_header_value_almost_done; ++ goto s_n_llhttp__internal__n_error_18; + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_18: { ++ s_n_llhttp__internal__n_error_19: { + state->error = 0xa; + state->reason = "Invalid header value char"; + state->error_pos = (const char*) p; +@@ -12538,7 +12782,7 @@ static llparse_state_t llhttp__internal_ + case 1: + goto s_n_llhttp__internal__n_header_value_lenient; + default: +- goto s_n_llhttp__internal__n_error_18; ++ goto s_n_llhttp__internal__n_header_value_lenient_failed; + } + /* UNREACHABLE */; + abort(); +@@ -12631,7 +12875,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_span_end_llhttp__on_header_value_4: { ++ s_n_llhttp__internal__n_span_end_llhttp__on_header_value_5: { + const unsigned char* start; + int err; + +@@ -12641,17 +12885,17 @@ static llparse_state_t llhttp__internal_ + if (err != 0) { + state->error = err; + state->error_pos = (const char*) p; +- state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_20; ++ state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_21; + return s_error; + } +- goto s_n_llhttp__internal__n_error_20; ++ goto s_n_llhttp__internal__n_error_21; + /* UNREACHABLE */; + abort(); + } + s_n_llhttp__internal__n_invoke_mul_add_content_length_1: { + switch (llhttp__internal__c_mul_add_content_length_1(state, p, endp, match)) { + case 1: +- goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_4; ++ goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_5; + default: + goto s_n_llhttp__internal__n_header_value_content_length; + } +@@ -12666,7 +12910,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_span_end_llhttp__on_header_value_5: { ++ s_n_llhttp__internal__n_span_end_llhttp__on_header_value_6: { + const unsigned char* start; + int err; + +@@ -12676,14 +12920,14 @@ static llparse_state_t llhttp__internal_ + if (err != 0) { + state->error = err; + state->error_pos = (const char*) p; +- state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_21; ++ state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_22; + return s_error; + } +- goto s_n_llhttp__internal__n_error_21; ++ goto s_n_llhttp__internal__n_error_22; + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_19: { ++ s_n_llhttp__internal__n_error_20: { + state->error = 0x4; + state->reason = "Duplicate Content-Length"; + state->error_pos = (const char*) p; +@@ -12697,11 +12941,29 @@ static llparse_state_t llhttp__internal_ + case 0: + goto s_n_llhttp__internal__n_header_value_content_length; + default: +- goto s_n_llhttp__internal__n_error_19; ++ goto s_n_llhttp__internal__n_error_20; + } + /* UNREACHABLE */; + abort(); + } ++ s_n_llhttp__internal__n_span_end_llhttp__on_header_value_8: { ++ const unsigned char* start; ++ int err; ++ ++ start = state->_span_pos0; ++ state->_span_pos0 = NULL; ++ err = llhttp__on_header_value(state, start, p); ++ if (err != 0) { ++ state->error = err; ++ state->error_pos = (const char*) (p + 1); ++ state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_24; ++ return s_error; ++ } ++ p++; ++ goto s_n_llhttp__internal__n_error_24; ++ /* UNREACHABLE */; ++ abort(); ++ } + s_n_llhttp__internal__n_invoke_update_header_state_7: { + switch (llhttp__internal__c_update_header_state_7(state, p, endp)) { + default: +@@ -12710,6 +12972,44 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } ++ s_n_llhttp__internal__n_span_end_llhttp__on_header_value_7: { ++ const unsigned char* start; ++ int err; ++ ++ start = state->_span_pos0; ++ state->_span_pos0 = NULL; ++ err = llhttp__on_header_value(state, start, p); ++ if (err != 0) { ++ state->error = err; ++ state->error_pos = (const char*) (p + 1); ++ state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_23; ++ return s_error; ++ } ++ p++; ++ goto s_n_llhttp__internal__n_error_23; ++ /* UNREACHABLE */; ++ abort(); ++ } ++ s_n_llhttp__internal__n_invoke_test_flags_8: { ++ switch (llhttp__internal__c_test_flags_2(state, p, endp)) { ++ case 0: ++ goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_7; ++ default: ++ goto s_n_llhttp__internal__n_header_value_te_chunked; ++ } ++ /* UNREACHABLE */; ++ abort(); ++ } ++ s_n_llhttp__internal__n_invoke_load_type_1: { ++ switch (llhttp__internal__c_load_type(state, p, endp)) { ++ case 1: ++ goto s_n_llhttp__internal__n_invoke_test_flags_8; ++ default: ++ goto s_n_llhttp__internal__n_header_value_te_chunked; ++ } ++ /* UNREACHABLE */; ++ abort(); ++ } + s_n_llhttp__internal__n_invoke_update_header_state_8: { + switch (llhttp__internal__c_update_header_state_4(state, p, endp)) { + default: +@@ -12726,6 +13026,34 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } ++ s_n_llhttp__internal__n_invoke_or_flags_17: { ++ switch (llhttp__internal__c_or_flags_16(state, p, endp)) { ++ default: ++ goto s_n_llhttp__internal__n_invoke_and_flags; ++ } ++ /* UNREACHABLE */; ++ abort(); ++ } ++ s_n_llhttp__internal__n_invoke_test_flags_9: { ++ switch (llhttp__internal__c_test_flags_2(state, p, endp)) { ++ case 0: ++ goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_8; ++ default: ++ goto s_n_llhttp__internal__n_invoke_or_flags_17; ++ } ++ /* UNREACHABLE */; ++ abort(); ++ } ++ s_n_llhttp__internal__n_invoke_load_type_2: { ++ switch (llhttp__internal__c_load_type(state, p, endp)) { ++ case 1: ++ goto s_n_llhttp__internal__n_invoke_test_flags_9; ++ default: ++ goto s_n_llhttp__internal__n_invoke_or_flags_17; ++ } ++ /* UNREACHABLE */; ++ abort(); ++ } + s_n_llhttp__internal__n_invoke_or_flags_16: { + switch (llhttp__internal__c_or_flags_16(state, p, endp)) { + default: +@@ -12734,8 +13062,18 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_or_flags_17: { +- switch (llhttp__internal__c_or_flags_17(state, p, endp)) { ++ s_n_llhttp__internal__n_invoke_test_flags_7: { ++ switch (llhttp__internal__c_test_flags_7(state, p, endp)) { ++ case 1: ++ goto s_n_llhttp__internal__n_invoke_load_type_2; ++ default: ++ goto s_n_llhttp__internal__n_invoke_or_flags_16; ++ } ++ /* UNREACHABLE */; ++ abort(); ++ } ++ s_n_llhttp__internal__n_invoke_or_flags_18: { ++ switch (llhttp__internal__c_or_flags_18(state, p, endp)) { + default: + goto s_n_llhttp__internal__n_invoke_update_header_state_8; + } +@@ -12749,9 +13087,9 @@ static llparse_state_t llhttp__internal_ + case 2: + goto s_n_llhttp__internal__n_invoke_test_flags_6; + case 3: +- goto s_n_llhttp__internal__n_invoke_or_flags_16; ++ goto s_n_llhttp__internal__n_invoke_test_flags_7; + case 4: +- goto s_n_llhttp__internal__n_invoke_or_flags_17; ++ goto s_n_llhttp__internal__n_invoke_or_flags_18; + default: + goto s_n_llhttp__internal__n_header_value; + } +@@ -12794,7 +13132,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_22: { ++ s_n_llhttp__internal__n_error_25: { + state->error = 0xa; + state->reason = "Invalid header token"; + state->error_pos = (const char*) p; +@@ -12860,7 +13198,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_23: { ++ s_n_llhttp__internal__n_error_26: { + state->error = 0x7; + state->reason = "Expected CRLF"; + state->error_pos = (const char*) p; +@@ -12886,7 +13224,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_24: { ++ s_n_llhttp__internal__n_error_27: { + state->error = 0x9; + state->reason = "Expected CRLF after version"; + state->error_pos = (const char*) p; +@@ -12903,7 +13241,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_25: { ++ s_n_llhttp__internal__n_error_28: { + state->error = 0x9; + state->reason = "Invalid minor version"; + state->error_pos = (const char*) p; +@@ -12912,7 +13250,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_26: { ++ s_n_llhttp__internal__n_error_29: { + state->error = 0x9; + state->reason = "Expected dot"; + state->error_pos = (const char*) p; +@@ -12929,7 +13267,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_27: { ++ s_n_llhttp__internal__n_error_30: { + state->error = 0x9; + state->reason = "Invalid major version"; + state->error_pos = (const char*) p; +@@ -12938,7 +13276,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_29: { ++ s_n_llhttp__internal__n_error_32: { + state->error = 0x8; + state->reason = "Expected HTTP/"; + state->error_pos = (const char*) p; +@@ -12947,7 +13285,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_28: { ++ s_n_llhttp__internal__n_error_31: { + state->error = 0x8; + state->reason = "Expected SOURCE method for ICE/x.x request"; + state->error_pos = (const char*) p; +@@ -12959,7 +13297,7 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_is_equal_method_1: { + switch (llhttp__internal__c_is_equal_method_1(state, p, endp)) { + case 0: +- goto s_n_llhttp__internal__n_error_28; ++ goto s_n_llhttp__internal__n_error_31; + default: + goto s_n_llhttp__internal__n_req_http_major; + } +@@ -13034,7 +13372,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_30: { ++ s_n_llhttp__internal__n_error_33: { + state->error = 0x7; + state->reason = "Invalid char in url fragment start"; + state->error_pos = (const char*) p; +@@ -13094,7 +13432,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_31: { ++ s_n_llhttp__internal__n_error_34: { + state->error = 0x7; + state->reason = "Invalid char in url query"; + state->error_pos = (const char*) p; +@@ -13103,7 +13441,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_32: { ++ s_n_llhttp__internal__n_error_35: { + state->error = 0x7; + state->reason = "Invalid char in url path"; + state->error_pos = (const char*) p; +@@ -13214,7 +13552,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_33: { ++ s_n_llhttp__internal__n_error_36: { + state->error = 0x7; + state->reason = "Double @ in url"; + state->error_pos = (const char*) p; +@@ -13223,7 +13561,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_34: { ++ s_n_llhttp__internal__n_error_37: { + state->error = 0x7; + state->reason = "Unexpected char in url server"; + state->error_pos = (const char*) p; +@@ -13232,7 +13570,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_35: { ++ s_n_llhttp__internal__n_error_38: { + state->error = 0x7; + state->reason = "Unexpected char in url server"; + state->error_pos = (const char*) p; +@@ -13241,7 +13579,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_37: { ++ s_n_llhttp__internal__n_error_40: { + state->error = 0x7; + state->reason = "Unexpected char in url schema"; + state->error_pos = (const char*) p; +@@ -13250,7 +13588,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_38: { ++ s_n_llhttp__internal__n_error_41: { + state->error = 0x7; + state->reason = "Unexpected char in url schema"; + state->error_pos = (const char*) p; +@@ -13259,7 +13597,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_39: { ++ s_n_llhttp__internal__n_error_42: { + state->error = 0x7; + state->reason = "Unexpected start char in url"; + state->error_pos = (const char*) p; +@@ -13278,7 +13616,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_40: { ++ s_n_llhttp__internal__n_error_43: { + state->error = 0x6; + state->reason = "Expected space after method"; + state->error_pos = (const char*) p; +@@ -13295,7 +13633,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_48: { ++ s_n_llhttp__internal__n_error_51: { + state->error = 0x6; + state->reason = "Invalid method encountered"; + state->error_pos = (const char*) p; +@@ -13304,7 +13642,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_41: { ++ s_n_llhttp__internal__n_error_44: { + state->error = 0xd; + state->reason = "Response overflow"; + state->error_pos = (const char*) p; +@@ -13316,7 +13654,7 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_mul_add_status_code: { + switch (llhttp__internal__c_mul_add_status_code(state, p, endp, match)) { + case 1: +- goto s_n_llhttp__internal__n_error_41; ++ goto s_n_llhttp__internal__n_error_44; + default: + goto s_n_llhttp__internal__n_res_status_code; + } +@@ -13359,7 +13697,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_42: { ++ s_n_llhttp__internal__n_error_45: { + state->error = 0xd; + state->reason = "Invalid response status"; + state->error_pos = (const char*) p; +@@ -13376,7 +13714,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_43: { ++ s_n_llhttp__internal__n_error_46: { + state->error = 0x9; + state->reason = "Expected space after version"; + state->error_pos = (const char*) p; +@@ -13393,7 +13731,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_44: { ++ s_n_llhttp__internal__n_error_47: { + state->error = 0x9; + state->reason = "Invalid minor version"; + state->error_pos = (const char*) p; +@@ -13402,7 +13740,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_45: { ++ s_n_llhttp__internal__n_error_48: { + state->error = 0x9; + state->reason = "Expected dot"; + state->error_pos = (const char*) p; +@@ -13419,7 +13757,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_46: { ++ s_n_llhttp__internal__n_error_49: { + state->error = 0x9; + state->reason = "Invalid major version"; + state->error_pos = (const char*) p; +@@ -13428,7 +13766,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_49: { ++ s_n_llhttp__internal__n_error_52: { + state->error = 0x8; + state->reason = "Expected HTTP/"; + state->error_pos = (const char*) p; +@@ -13453,7 +13791,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_47: { ++ s_n_llhttp__internal__n_error_50: { + state->error = 0x8; + state->reason = "Invalid word encountered"; + state->error_pos = (const char*) p; +Index: node-v12.22.12/test/parallel/test-http-invalid-te.js +=================================================================== +--- node-v12.22.12.orig/test/parallel/test-http-invalid-te.js ++++ node-v12.22.12/test/parallel/test-http-invalid-te.js +@@ -13,7 +13,7 @@ Content-Type: text/plain; charset=utf-8 + Host: hacker.exploit.com + Connection: keep-alive + Content-Length: 10 +-Transfer-Encoding: chunked, eee ++Transfer-Encoding: eee, chunked + + HELLOWORLDPOST / HTTP/1.1 + Content-Type: text/plain; charset=utf-8 +Index: node-v12.22.12/test/parallel/test-http-missing-header-separator-cr.js +=================================================================== +--- /dev/null ++++ node-v12.22.12/test/parallel/test-http-missing-header-separator-cr.js +@@ -0,0 +1,43 @@ ++'use strict'; ++ ++const common = require('../common'); ++const assert = require('assert'); ++ ++const http = require('http'); ++const net = require('net'); ++ ++const msg = [ ++ 'GET / HTTP/1.1', ++ 'Host: localhost', ++ 'Dummy: x\nContent-Length: 23', ++ '', ++ 'GET / HTTP/1.1', ++ 'Dummy: GET /admin HTTP/1.1', ++ 'Host: localhost', ++ '', ++ '', ++].join('\r\n'); ++ ++const server = http.createServer(common.mustNotCall()); ++ ++server.listen(0, common.mustSucceed(() => { ++ const client = net.connect(server.address().port, 'localhost'); ++ ++ let response = ''; ++ ++ client.on('data', common.mustCall((chunk) => { ++ response += chunk.toString('utf-8'); ++ })); ++ ++ client.setEncoding('utf8'); ++ client.on('error', common.mustNotCall()); ++ client.on('end', common.mustCall(() => { ++ assert.strictEqual( ++ response, ++ 'HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n' ++ ); ++ server.close(); ++ })); ++ client.write(msg); ++ client.resume(); ++})); +Index: node-v12.22.12/test/parallel/test-http-transfer-encoding-repeated-chunked.js +=================================================================== +--- /dev/null ++++ node-v12.22.12/test/parallel/test-http-transfer-encoding-repeated-chunked.js +@@ -0,0 +1,51 @@ ++'use strict'; ++ ++const common = require('../common'); ++const assert = require('assert'); ++ ++const http = require('http'); ++const net = require('net'); ++ ++const msg = [ ++ 'POST / HTTP/1.1', ++ 'Host: 127.0.0.1', ++ 'Transfer-Encoding: chunkedchunked', ++ '', ++ '1', ++ 'A', ++ '0', ++ '', ++].join('\r\n'); ++ ++const server = http.createServer(common.mustCall((req, res) => { ++ // Verify that no data is received ++ ++ req.on('data', common.mustNotCall()); ++ ++ req.on('end', common.mustNotCall(() => { ++ res.writeHead(200, { 'Content-Type': 'text/plain' }); ++ res.end(); ++ })); ++}, 1)); ++ ++server.listen(0, common.mustSucceed(() => { ++ const client = net.connect(server.address().port, 'localhost'); ++ ++ let response = ''; ++ ++ client.on('data', common.mustCall((chunk) => { ++ response += chunk.toString('utf-8'); ++ })); ++ ++ client.setEncoding('utf8'); ++ client.on('error', common.mustNotCall()); ++ client.on('end', common.mustCall(() => { ++ assert.strictEqual( ++ response, ++ 'HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n' ++ ); ++ server.close(); ++ })); ++ client.write(msg); ++ client.resume(); ++})); +Index: node-v12.22.12/test/parallel/test-http-transfer-encoding-smuggling.js +=================================================================== +--- node-v12.22.12.orig/test/parallel/test-http-transfer-encoding-smuggling.js ++++ node-v12.22.12/test/parallel/test-http-transfer-encoding-smuggling.js +@@ -1,8 +1,8 @@ + 'use strict'; + + const common = require('../common'); +- + const assert = require('assert'); ++ + const http = require('http'); + const net = require('net'); + +@@ -23,24 +23,30 @@ const msg = [ + '', + ].join('\r\n'); + +-// Verify that the server is called only once even with a smuggled request. +- +-const server = http.createServer(common.mustCall((req, res) => { ++const server = http.createServer(common.mustNotCall((req, res) => { + res.end(); + }, 1)); + +-function send(next) { ++server.listen(0, common.mustSucceed(() => { + const client = net.connect(server.address().port, 'localhost'); ++ ++ let response = ''; ++ ++ // Verify that the server listener is never called ++ ++ client.on('data', common.mustCall((chunk) => { ++ response += chunk.toString('utf-8'); ++ })); ++ + client.setEncoding('utf8'); + client.on('error', common.mustNotCall()); +- client.on('end', next); +- client.write(msg); +- client.resume(); +-} +- +-server.listen(0, common.mustCall((err) => { +- assert.ifError(err); +- send(common.mustCall(() => { ++ client.on('end', common.mustCall(() => { ++ assert.strictEqual( ++ response, ++ 'HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n' ++ ); + server.close(); + })); ++ client.write(msg); ++ client.resume(); + })); +Index: node-v12.22.12/test/common/index.js +=================================================================== +--- node-v12.22.12.orig/test/common/index.js ++++ node-v12.22.12/test/common/index.js +@@ -332,6 +332,14 @@ function mustCall(fn, exact) { + return _mustCallInner(fn, exact, 'exact'); + } + ++function mustSucceed(fn, exact) { ++ return mustCall(function(err, ...args) { ++ assert.ifError(err); ++ if (typeof fn === 'function') ++ return fn.apply(this, args); ++ }, exact); ++} ++ + function mustCallAtLeast(fn, minimum) { + return _mustCallInner(fn, minimum, 'minimum'); + } +@@ -735,6 +743,7 @@ const common = { + isWindows, + localIPv6Hosts, + mustCall, ++ mustSucceed, + mustCallAtLeast, + mustNotCall, + nodeProcessAborted, diff --git a/CVE-2022-35256.patch b/CVE-2022-35256.patch new file mode 100644 index 0000000000000000000000000000000000000000..5c61ac3cd02edba8bfdab62722f7329e27b30db1 --- /dev/null +++ b/CVE-2022-35256.patch @@ -0,0 +1,1581 @@ +From a9f1146b8827855e342834458a71f2367346ace0 Mon Sep 17 00:00:00 2001 +From: Paolo Insogna +Date: Thu, 22 Sep 2022 13:07:36 +0000 +Subject: [PATCH] http: disable chunked encoding when OBS fold is used + +Reviewed-By: Vladimir de Turckheim +Reviewed-By: Matteo Collina +PR-URL: https://github.com/nodejs-private/node-private/pull/341 +Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/343 +CVE-ID: CVE-2022-32213, CVE-2022-35256 +--- + deps/llhttp/include/llhttp.h | 2 +- + deps/llhttp/src/llhttp.c | 448 +++++++++--------- + test/parallel/test-http-header-overflow.js | 9 +- + .../test-http-missing-header-separator-cr.js | 72 ++- + .../test-http-transfer-encoding-smuggling.js | 119 +++-- + 5 files changed, 371 insertions(+), 279 deletions(-) + +Index: node-v12.22.12/deps/llhttp/include/llhttp.h +=================================================================== +--- node-v12.22.12.orig/deps/llhttp/include/llhttp.h ++++ node-v12.22.12/deps/llhttp/include/llhttp.h +@@ -3,7 +3,7 @@ + + #define LLHTTP_VERSION_MAJOR 2 + #define LLHTTP_VERSION_MINOR 1 +-#define LLHTTP_VERSION_PATCH 5 ++#define LLHTTP_VERSION_PATCH 6 + + #ifndef LLHTTP_STRICT_MODE + # define LLHTTP_STRICT_MODE 0 +Index: node-v12.22.12/deps/llhttp/src/llhttp.c +=================================================================== +--- node-v12.22.12.orig/deps/llhttp/src/llhttp.c ++++ node-v12.22.12/deps/llhttp/src/llhttp.c +@@ -325,8 +325,7 @@ enum llparse_state_e { + s_n_llhttp__internal__n_header_value_lws, + s_n_llhttp__internal__n_header_value_almost_done, + s_n_llhttp__internal__n_header_value_lenient, +- s_n_llhttp__internal__n_error_24, +- s_n_llhttp__internal__n_header_value_lenient_failed, ++ s_n_llhttp__internal__n_error_25, + s_n_llhttp__internal__n_header_value_otherwise, + s_n_llhttp__internal__n_header_value_connection_token, + s_n_llhttp__internal__n_header_value_connection_ws, +@@ -738,7 +737,7 @@ int llhttp__internal__c_or_flags_6( + return 0; + } + +-int llhttp__internal__c_update_header_state_2( ++int llhttp__internal__c_update_header_state_3( + llhttp__internal_t* state, + const unsigned char* p, + const unsigned char* endp) { +@@ -746,7 +745,7 @@ int llhttp__internal__c_update_header_st + return 0; + } + +-int llhttp__internal__c_update_header_state_4( ++int llhttp__internal__c_update_header_state_1( + llhttp__internal_t* state, + const unsigned char* p, + const unsigned char* endp) { +@@ -754,7 +753,7 @@ int llhttp__internal__c_update_header_st + return 0; + } + +-int llhttp__internal__c_update_header_state_5( ++int llhttp__internal__c_update_header_state_6( + llhttp__internal_t* state, + const unsigned char* p, + const unsigned char* endp) { +@@ -762,7 +761,7 @@ int llhttp__internal__c_update_header_st + return 0; + } + +-int llhttp__internal__c_update_header_state_6( ++int llhttp__internal__c_update_header_state_7( + llhttp__internal_t* state, + const unsigned char* p, + const unsigned char* endp) { +@@ -770,7 +769,7 @@ int llhttp__internal__c_update_header_st + return 0; + } + +-int llhttp__internal__c_test_flags_6( ++int llhttp__internal__c_test_flags_7( + llhttp__internal_t* state, + const unsigned char* p, + const unsigned char* endp) { +@@ -811,7 +810,7 @@ int llhttp__internal__c_or_flags_15( + return 0; + } + +-int llhttp__internal__c_test_flags_7( ++int llhttp__internal__c_test_flags_8( + llhttp__internal_t* state, + const unsigned char* p, + const unsigned char* endp) { +@@ -834,7 +833,7 @@ int llhttp__internal__c_and_flags( + return 0; + } + +-int llhttp__internal__c_update_header_state_7( ++int llhttp__internal__c_update_header_state_8( + llhttp__internal_t* state, + const unsigned char* p, + const unsigned char* endp) { +@@ -1565,7 +1564,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_header_value_discard_lws; + } + default: { +- goto s_n_llhttp__internal__n_error_22; ++ goto s_n_llhttp__internal__n_error_23; + } + } + /* UNREACHABLE */; +@@ -1578,13 +1577,13 @@ static llparse_state_t llhttp__internal_ + } + switch (*p) { + case 9: { +- goto s_n_llhttp__internal__n_span_start_llhttp__on_header_value_1; ++ goto s_n_llhttp__internal__n_invoke_load_header_state_3; + } + case ' ': { +- goto s_n_llhttp__internal__n_span_start_llhttp__on_header_value_1; ++ goto s_n_llhttp__internal__n_invoke_load_header_state_3; + } + default: { +- goto s_n_llhttp__internal__n_invoke_load_header_state_3; ++ goto s_n_llhttp__internal__n_invoke_load_header_state_4; + } + } + /* UNREACHABLE */; +@@ -1601,7 +1600,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_header_value_lws; + } + default: { +- goto s_n_llhttp__internal__n_error_23; ++ goto s_n_llhttp__internal__n_error_24; + } + } + /* UNREACHABLE */; +@@ -1627,32 +1626,16 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- case s_n_llhttp__internal__n_error_24: +- s_n_llhttp__internal__n_error_24: { +- state->error = 0x19; +- state->reason = "Missing expected CR after header value"; ++ case s_n_llhttp__internal__n_error_25: ++ s_n_llhttp__internal__n_error_25: { ++ state->error = 0xa; ++ state->reason = "Invalid header value char"; + state->error_pos = (const char*) p; + state->_current = (void*) (intptr_t) s_error; + return s_error; + /* UNREACHABLE */; + abort(); + } +- case s_n_llhttp__internal__n_header_value_lenient_failed: +- s_n_llhttp__internal__n_header_value_lenient_failed: { +- if (p == endp) { +- return s_n_llhttp__internal__n_header_value_lenient_failed; +- } +- switch (*p) { +- case 10: { +- goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_2; +- } +- default: { +- goto s_n_llhttp__internal__n_error_25; +- } +- } +- /* UNREACHABLE */; +- abort(); +- } + case s_n_llhttp__internal__n_header_value_otherwise: + s_n_llhttp__internal__n_header_value_otherwise: { + if (p == endp) { +@@ -1663,7 +1646,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_1; + } + default: { +- goto s_n_llhttp__internal__n_invoke_test_flags_5; ++ goto s_n_llhttp__internal__n_invoke_test_flags_6; + } + } + /* UNREACHABLE */; +@@ -1726,10 +1709,10 @@ static llparse_state_t llhttp__internal_ + } + case ',': { + p++; +- goto s_n_llhttp__internal__n_invoke_load_header_state_4; ++ goto s_n_llhttp__internal__n_invoke_load_header_state_5; + } + default: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_4; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_5; + } + } + /* UNREACHABLE */; +@@ -1747,7 +1730,7 @@ static llparse_state_t llhttp__internal_ + switch (match_seq.status) { + case kMatchComplete: { + p++; +- goto s_n_llhttp__internal__n_invoke_update_header_state_2; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_3; + } + case kMatchPause: { + return s_n_llhttp__internal__n_header_value_connection_1; +@@ -1771,7 +1754,7 @@ static llparse_state_t llhttp__internal_ + switch (match_seq.status) { + case kMatchComplete: { + p++; +- goto s_n_llhttp__internal__n_invoke_update_header_state_5; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_6; + } + case kMatchPause: { + return s_n_llhttp__internal__n_header_value_connection_2; +@@ -1795,7 +1778,7 @@ static llparse_state_t llhttp__internal_ + switch (match_seq.status) { + case kMatchComplete: { + p++; +- goto s_n_llhttp__internal__n_invoke_update_header_state_6; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_7; + } + case kMatchPause: { + return s_n_llhttp__internal__n_header_value_connection_3; +@@ -2079,7 +2062,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_header_value_te_token_ows; + } + default: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_8; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_9; + } + } + /* UNREACHABLE */; +@@ -2092,10 +2075,10 @@ static llparse_state_t llhttp__internal_ + } + switch (*p) { + case 10: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_7; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_8; + } + case 13: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_7; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_8; + } + case ' ': { + p++; +@@ -2158,7 +2141,7 @@ static llparse_state_t llhttp__internal_ + } + case 10: { + p++; +- goto s_n_llhttp__internal__n_header_value_discard_lws; ++ goto s_n_llhttp__internal__n_invoke_test_flags_5; + } + case 13: { + p++; +@@ -2275,7 +2258,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_span_end_llhttp__on_header_field_1; + } + default: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_9; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_10; + } + } + /* UNREACHABLE */; +@@ -2300,7 +2283,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_header_field_3; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_10; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_11; + } + } + /* UNREACHABLE */; +@@ -2325,7 +2308,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_header_field_4; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_10; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_11; + } + } + /* UNREACHABLE */; +@@ -2346,7 +2329,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_header_field_4; + } + default: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_10; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_11; + } + } + /* UNREACHABLE */; +@@ -2370,7 +2353,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_header_field_1; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_10; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_11; + } + } + /* UNREACHABLE */; +@@ -2395,7 +2378,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_header_field_5; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_10; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_11; + } + } + /* UNREACHABLE */; +@@ -2420,7 +2403,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_header_field_6; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_10; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_11; + } + } + /* UNREACHABLE */; +@@ -2445,7 +2428,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_header_field_7; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_10; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_11; + } + } + /* UNREACHABLE */; +@@ -2474,7 +2457,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_header_field_7; + } + default: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_10; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_11; + } + } + /* UNREACHABLE */; +@@ -5712,7 +5695,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_21: { ++ s_n_llhttp__internal__n_error_22: { + state->error = 0xb; + state->reason = "Empty Content-Length"; + state->error_pos = (const char*) p; +@@ -5797,14 +5780,33 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_load_header_state: { + switch (llhttp__internal__c_load_header_state(state, p, endp)) { + case 2: +- goto s_n_llhttp__internal__n_error_21; ++ goto s_n_llhttp__internal__n_error_22; + default: + goto s_n_llhttp__internal__n_invoke_load_header_state_1; + } + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_22: { ++ s_n_llhttp__internal__n_error_21: { ++ state->error = 0xa; ++ state->reason = "Invalid header value char"; ++ state->error_pos = (const char*) p; ++ state->_current = (void*) (intptr_t) s_error; ++ return s_error; ++ /* UNREACHABLE */; ++ abort(); ++ } ++ s_n_llhttp__internal__n_invoke_test_flags_5: { ++ switch (llhttp__internal__c_test_flags_2(state, p, endp)) { ++ case 1: ++ goto s_n_llhttp__internal__n_header_value_discard_lws; ++ default: ++ goto s_n_llhttp__internal__n_error_21; ++ } ++ /* UNREACHABLE */; ++ abort(); ++ } ++ s_n_llhttp__internal__n_error_23: { + state->error = 0x2; + state->reason = "Expected LF after CR"; + state->error_pos = (const char*) p; +@@ -5814,6 +5816,24 @@ static llparse_state_t llhttp__internal_ + abort(); + } + s_n_llhttp__internal__n_invoke_update_header_state_1: { ++ switch (llhttp__internal__c_update_header_state_1(state, p, endp)) { ++ default: ++ goto s_n_llhttp__internal__n_span_start_llhttp__on_header_value_1; ++ } ++ /* UNREACHABLE */; ++ abort(); ++ } ++ s_n_llhttp__internal__n_invoke_load_header_state_3: { ++ switch (llhttp__internal__c_load_header_state(state, p, endp)) { ++ case 8: ++ goto s_n_llhttp__internal__n_invoke_update_header_state_1; ++ default: ++ goto s_n_llhttp__internal__n_span_start_llhttp__on_header_value_1; ++ } ++ /* UNREACHABLE */; ++ abort(); ++ } ++ s_n_llhttp__internal__n_invoke_update_header_state_2: { + switch (llhttp__internal__c_update_header_state(state, p, endp)) { + default: + goto s_n_llhttp__internal__n_header_field_start; +@@ -5824,7 +5844,7 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_or_flags_7: { + switch (llhttp__internal__c_or_flags_3(state, p, endp)) { + default: +- goto s_n_llhttp__internal__n_invoke_update_header_state_1; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_2; + } + /* UNREACHABLE */; + abort(); +@@ -5832,7 +5852,7 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_or_flags_8: { + switch (llhttp__internal__c_or_flags_4(state, p, endp)) { + default: +- goto s_n_llhttp__internal__n_invoke_update_header_state_1; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_2; + } + /* UNREACHABLE */; + abort(); +@@ -5840,7 +5860,7 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_or_flags_9: { + switch (llhttp__internal__c_or_flags_5(state, p, endp)) { + default: +- goto s_n_llhttp__internal__n_invoke_update_header_state_1; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_2; + } + /* UNREACHABLE */; + abort(); +@@ -5853,7 +5873,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_load_header_state_3: { ++ s_n_llhttp__internal__n_invoke_load_header_state_4: { + switch (llhttp__internal__c_load_header_state(state, p, endp)) { + case 5: + goto s_n_llhttp__internal__n_invoke_or_flags_7; +@@ -5869,7 +5889,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_23: { ++ s_n_llhttp__internal__n_error_24: { + state->error = 0x3; + state->reason = "Missing expected LF after header value"; + state->error_pos = (const char*) p; +@@ -5940,35 +5960,25 @@ static llparse_state_t llhttp__internal_ + err = llhttp__on_header_value(state, start, p); + if (err != 0) { + state->error = err; +- state->error_pos = (const char*) (p + 1); +- state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_24; ++ state->error_pos = (const char*) p; ++ state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_25; + return s_error; + } +- p++; +- goto s_n_llhttp__internal__n_error_24; +- /* UNREACHABLE */; +- abort(); +- } +- s_n_llhttp__internal__n_error_25: { +- state->error = 0xa; +- state->reason = "Invalid header value char"; +- state->error_pos = (const char*) p; +- state->_current = (void*) (intptr_t) s_error; +- return s_error; ++ goto s_n_llhttp__internal__n_error_25; + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_test_flags_5: { ++ s_n_llhttp__internal__n_invoke_test_flags_6: { + switch (llhttp__internal__c_test_flags_2(state, p, endp)) { + case 1: + goto s_n_llhttp__internal__n_header_value_lenient; + default: +- goto s_n_llhttp__internal__n_header_value_lenient_failed; ++ goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_2; + } + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_update_header_state_3: { ++ s_n_llhttp__internal__n_invoke_update_header_state_4: { + switch (llhttp__internal__c_update_header_state(state, p, endp)) { + default: + goto s_n_llhttp__internal__n_header_value_connection; +@@ -5979,7 +5989,7 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_or_flags_11: { + switch (llhttp__internal__c_or_flags_3(state, p, endp)) { + default: +- goto s_n_llhttp__internal__n_invoke_update_header_state_3; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_4; + } + /* UNREACHABLE */; + abort(); +@@ -5987,7 +5997,7 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_or_flags_12: { + switch (llhttp__internal__c_or_flags_4(state, p, endp)) { + default: +- goto s_n_llhttp__internal__n_invoke_update_header_state_3; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_4; + } + /* UNREACHABLE */; + abort(); +@@ -5995,7 +6005,7 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_or_flags_13: { + switch (llhttp__internal__c_or_flags_5(state, p, endp)) { + default: +- goto s_n_llhttp__internal__n_invoke_update_header_state_3; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_4; + } + /* UNREACHABLE */; + abort(); +@@ -6008,7 +6018,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_load_header_state_4: { ++ s_n_llhttp__internal__n_invoke_load_header_state_5: { + switch (llhttp__internal__c_load_header_state(state, p, endp)) { + case 5: + goto s_n_llhttp__internal__n_invoke_or_flags_11; +@@ -6024,32 +6034,32 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_update_header_state_4: { +- switch (llhttp__internal__c_update_header_state_4(state, p, endp)) { ++ s_n_llhttp__internal__n_invoke_update_header_state_5: { ++ switch (llhttp__internal__c_update_header_state_1(state, p, endp)) { + default: + goto s_n_llhttp__internal__n_header_value_connection_token; + } + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_update_header_state_2: { +- switch (llhttp__internal__c_update_header_state_2(state, p, endp)) { ++ s_n_llhttp__internal__n_invoke_update_header_state_3: { ++ switch (llhttp__internal__c_update_header_state_3(state, p, endp)) { + default: + goto s_n_llhttp__internal__n_header_value_connection_ws; + } + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_update_header_state_5: { +- switch (llhttp__internal__c_update_header_state_5(state, p, endp)) { ++ s_n_llhttp__internal__n_invoke_update_header_state_6: { ++ switch (llhttp__internal__c_update_header_state_6(state, p, endp)) { + default: + goto s_n_llhttp__internal__n_header_value_connection_ws; + } + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_update_header_state_6: { +- switch (llhttp__internal__c_update_header_state_6(state, p, endp)) { ++ s_n_llhttp__internal__n_invoke_update_header_state_7: { ++ switch (llhttp__internal__c_update_header_state_7(state, p, endp)) { + default: + goto s_n_llhttp__internal__n_header_value_connection_ws; + } +@@ -6117,8 +6127,8 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_test_flags_6: { +- switch (llhttp__internal__c_test_flags_6(state, p, endp)) { ++ s_n_llhttp__internal__n_invoke_test_flags_7: { ++ switch (llhttp__internal__c_test_flags_7(state, p, endp)) { + case 0: + goto s_n_llhttp__internal__n_header_value_content_length; + default: +@@ -6145,8 +6155,8 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_update_header_state_7: { +- switch (llhttp__internal__c_update_header_state_7(state, p, endp)) { ++ s_n_llhttp__internal__n_invoke_update_header_state_8: { ++ switch (llhttp__internal__c_update_header_state_8(state, p, endp)) { + default: + goto s_n_llhttp__internal__n_header_value_otherwise; + } +@@ -6171,7 +6181,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_test_flags_8: { ++ s_n_llhttp__internal__n_invoke_test_flags_9: { + switch (llhttp__internal__c_test_flags_2(state, p, endp)) { + case 0: + goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_7; +@@ -6184,15 +6194,15 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_load_type_1: { + switch (llhttp__internal__c_load_type(state, p, endp)) { + case 1: +- goto s_n_llhttp__internal__n_invoke_test_flags_8; ++ goto s_n_llhttp__internal__n_invoke_test_flags_9; + default: + goto s_n_llhttp__internal__n_header_value_te_chunked; + } + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_update_header_state_8: { +- switch (llhttp__internal__c_update_header_state_4(state, p, endp)) { ++ s_n_llhttp__internal__n_invoke_update_header_state_9: { ++ switch (llhttp__internal__c_update_header_state_1(state, p, endp)) { + default: + goto s_n_llhttp__internal__n_header_value; + } +@@ -6215,7 +6225,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_test_flags_9: { ++ s_n_llhttp__internal__n_invoke_test_flags_10: { + switch (llhttp__internal__c_test_flags_2(state, p, endp)) { + case 0: + goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_8; +@@ -6228,7 +6238,7 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_load_type_2: { + switch (llhttp__internal__c_load_type(state, p, endp)) { + case 1: +- goto s_n_llhttp__internal__n_invoke_test_flags_9; ++ goto s_n_llhttp__internal__n_invoke_test_flags_10; + default: + goto s_n_llhttp__internal__n_invoke_or_flags_17; + } +@@ -6243,8 +6253,8 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_test_flags_7: { +- switch (llhttp__internal__c_test_flags_7(state, p, endp)) { ++ s_n_llhttp__internal__n_invoke_test_flags_8: { ++ switch (llhttp__internal__c_test_flags_8(state, p, endp)) { + case 1: + goto s_n_llhttp__internal__n_invoke_load_type_2; + default: +@@ -6256,7 +6266,7 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_or_flags_18: { + switch (llhttp__internal__c_or_flags_18(state, p, endp)) { + default: +- goto s_n_llhttp__internal__n_invoke_update_header_state_8; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_9; + } + /* UNREACHABLE */; + abort(); +@@ -6266,9 +6276,9 @@ static llparse_state_t llhttp__internal_ + case 1: + goto s_n_llhttp__internal__n_header_value_connection; + case 2: +- goto s_n_llhttp__internal__n_invoke_test_flags_6; +- case 3: + goto s_n_llhttp__internal__n_invoke_test_flags_7; ++ case 3: ++ goto s_n_llhttp__internal__n_invoke_test_flags_8; + case 4: + goto s_n_llhttp__internal__n_invoke_or_flags_18; + default: +@@ -6322,8 +6332,8 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_update_header_state_9: { +- switch (llhttp__internal__c_update_header_state_4(state, p, endp)) { ++ s_n_llhttp__internal__n_invoke_update_header_state_10: { ++ switch (llhttp__internal__c_update_header_state_1(state, p, endp)) { + default: + goto s_n_llhttp__internal__n_header_field_general; + } +@@ -6338,8 +6348,8 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_update_header_state_10: { +- switch (llhttp__internal__c_update_header_state_4(state, p, endp)) { ++ s_n_llhttp__internal__n_invoke_update_header_state_11: { ++ switch (llhttp__internal__c_update_header_state_1(state, p, endp)) { + default: + goto s_n_llhttp__internal__n_header_field_general; + } +@@ -7413,8 +7423,7 @@ enum llparse_state_e { + s_n_llhttp__internal__n_header_value_lws, + s_n_llhttp__internal__n_header_value_almost_done, + s_n_llhttp__internal__n_header_value_lenient, +- s_n_llhttp__internal__n_error_18, +- s_n_llhttp__internal__n_header_value_lenient_failed, ++ s_n_llhttp__internal__n_error_19, + s_n_llhttp__internal__n_header_value_otherwise, + s_n_llhttp__internal__n_header_value_connection_token, + s_n_llhttp__internal__n_header_value_connection_ws, +@@ -7821,7 +7830,7 @@ int llhttp__internal__c_or_flags_6( + return 0; + } + +-int llhttp__internal__c_update_header_state_2( ++int llhttp__internal__c_update_header_state_3( + llhttp__internal_t* state, + const unsigned char* p, + const unsigned char* endp) { +@@ -7829,7 +7838,7 @@ int llhttp__internal__c_update_header_st + return 0; + } + +-int llhttp__internal__c_update_header_state_4( ++int llhttp__internal__c_update_header_state_1( + llhttp__internal_t* state, + const unsigned char* p, + const unsigned char* endp) { +@@ -7837,7 +7846,7 @@ int llhttp__internal__c_update_header_st + return 0; + } + +-int llhttp__internal__c_update_header_state_5( ++int llhttp__internal__c_update_header_state_6( + llhttp__internal_t* state, + const unsigned char* p, + const unsigned char* endp) { +@@ -7845,7 +7854,7 @@ int llhttp__internal__c_update_header_st + return 0; + } + +-int llhttp__internal__c_update_header_state_6( ++int llhttp__internal__c_update_header_state_7( + llhttp__internal_t* state, + const unsigned char* p, + const unsigned char* endp) { +@@ -7853,7 +7862,7 @@ int llhttp__internal__c_update_header_st + return 0; + } + +-int llhttp__internal__c_test_flags_6( ++int llhttp__internal__c_test_flags_7( + llhttp__internal_t* state, + const unsigned char* p, + const unsigned char* endp) { +@@ -7894,7 +7903,7 @@ int llhttp__internal__c_or_flags_15( + return 0; + } + +-int llhttp__internal__c_test_flags_7( ++int llhttp__internal__c_test_flags_8( + llhttp__internal_t* state, + const unsigned char* p, + const unsigned char* endp) { +@@ -7917,7 +7926,7 @@ int llhttp__internal__c_and_flags( + return 0; + } + +-int llhttp__internal__c_update_header_state_7( ++int llhttp__internal__c_update_header_state_8( + llhttp__internal_t* state, + const unsigned char* p, + const unsigned char* endp) { +@@ -8612,13 +8621,13 @@ static llparse_state_t llhttp__internal_ + } + switch (*p) { + case 9: { +- goto s_n_llhttp__internal__n_span_start_llhttp__on_header_value_1; ++ goto s_n_llhttp__internal__n_invoke_load_header_state_3; + } + case ' ': { +- goto s_n_llhttp__internal__n_span_start_llhttp__on_header_value_1; ++ goto s_n_llhttp__internal__n_invoke_load_header_state_3; + } + default: { +- goto s_n_llhttp__internal__n_invoke_load_header_state_3; ++ goto s_n_llhttp__internal__n_invoke_load_header_state_4; + } + } + /* UNREACHABLE */; +@@ -8635,7 +8644,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_header_value_lws; + } + default: { +- goto s_n_llhttp__internal__n_error_17; ++ goto s_n_llhttp__internal__n_error_18; + } + } + /* UNREACHABLE */; +@@ -8661,32 +8670,16 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- case s_n_llhttp__internal__n_error_18: +- s_n_llhttp__internal__n_error_18: { +- state->error = 0x19; +- state->reason = "Missing expected CR after header value"; ++ case s_n_llhttp__internal__n_error_19: ++ s_n_llhttp__internal__n_error_19: { ++ state->error = 0xa; ++ state->reason = "Invalid header value char"; + state->error_pos = (const char*) p; + state->_current = (void*) (intptr_t) s_error; + return s_error; + /* UNREACHABLE */; + abort(); + } +- case s_n_llhttp__internal__n_header_value_lenient_failed: +- s_n_llhttp__internal__n_header_value_lenient_failed: { +- if (p == endp) { +- return s_n_llhttp__internal__n_header_value_lenient_failed; +- } +- switch (*p) { +- case 10: { +- goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_2; +- } +- default: { +- goto s_n_llhttp__internal__n_error_19; +- } +- } +- /* UNREACHABLE */; +- abort(); +- } + case s_n_llhttp__internal__n_header_value_otherwise: + s_n_llhttp__internal__n_header_value_otherwise: { + if (p == endp) { +@@ -8697,7 +8690,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_1; + } + default: { +- goto s_n_llhttp__internal__n_invoke_test_flags_5; ++ goto s_n_llhttp__internal__n_invoke_test_flags_6; + } + } + /* UNREACHABLE */; +@@ -8760,10 +8753,10 @@ static llparse_state_t llhttp__internal_ + } + case ',': { + p++; +- goto s_n_llhttp__internal__n_invoke_load_header_state_4; ++ goto s_n_llhttp__internal__n_invoke_load_header_state_5; + } + default: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_4; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_5; + } + } + /* UNREACHABLE */; +@@ -8781,7 +8774,7 @@ static llparse_state_t llhttp__internal_ + switch (match_seq.status) { + case kMatchComplete: { + p++; +- goto s_n_llhttp__internal__n_invoke_update_header_state_2; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_3; + } + case kMatchPause: { + return s_n_llhttp__internal__n_header_value_connection_1; +@@ -8805,7 +8798,7 @@ static llparse_state_t llhttp__internal_ + switch (match_seq.status) { + case kMatchComplete: { + p++; +- goto s_n_llhttp__internal__n_invoke_update_header_state_5; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_6; + } + case kMatchPause: { + return s_n_llhttp__internal__n_header_value_connection_2; +@@ -8829,7 +8822,7 @@ static llparse_state_t llhttp__internal_ + switch (match_seq.status) { + case kMatchComplete: { + p++; +- goto s_n_llhttp__internal__n_invoke_update_header_state_6; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_7; + } + case kMatchPause: { + return s_n_llhttp__internal__n_header_value_connection_3; +@@ -9113,7 +9106,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_header_value_te_token_ows; + } + default: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_8; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_9; + } + } + /* UNREACHABLE */; +@@ -9126,10 +9119,10 @@ static llparse_state_t llhttp__internal_ + } + switch (*p) { + case 10: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_7; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_8; + } + case 13: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_7; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_8; + } + case ' ': { + p++; +@@ -9192,7 +9185,7 @@ static llparse_state_t llhttp__internal_ + } + case 10: { + p++; +- goto s_n_llhttp__internal__n_header_value_discard_lws; ++ goto s_n_llhttp__internal__n_invoke_test_flags_5; + } + case 13: { + p++; +@@ -9309,7 +9302,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_span_end_llhttp__on_header_field_1; + } + default: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_9; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_10; + } + } + /* UNREACHABLE */; +@@ -9334,7 +9327,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_header_field_3; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_10; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_11; + } + } + /* UNREACHABLE */; +@@ -9359,7 +9352,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_header_field_4; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_10; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_11; + } + } + /* UNREACHABLE */; +@@ -9380,7 +9373,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_header_field_4; + } + default: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_10; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_11; + } + } + /* UNREACHABLE */; +@@ -9404,7 +9397,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_header_field_1; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_10; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_11; + } + } + /* UNREACHABLE */; +@@ -9429,7 +9422,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_header_field_5; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_10; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_11; + } + } + /* UNREACHABLE */; +@@ -9454,7 +9447,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_header_field_6; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_10; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_11; + } + } + /* UNREACHABLE */; +@@ -9479,7 +9472,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_header_field_7; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_10; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_11; + } + } + /* UNREACHABLE */; +@@ -9508,7 +9501,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_header_field_7; + } + default: { +- goto s_n_llhttp__internal__n_invoke_update_header_state_10; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_11; + } + } + /* UNREACHABLE */; +@@ -12540,7 +12533,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_16: { ++ s_n_llhttp__internal__n_error_17: { + state->error = 0xb; + state->reason = "Empty Content-Length"; + state->error_pos = (const char*) p; +@@ -12625,14 +12618,51 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_load_header_state: { + switch (llhttp__internal__c_load_header_state(state, p, endp)) { + case 2: +- goto s_n_llhttp__internal__n_error_16; ++ goto s_n_llhttp__internal__n_error_17; + default: + goto s_n_llhttp__internal__n_invoke_load_header_state_1; + } + /* UNREACHABLE */; + abort(); + } ++ s_n_llhttp__internal__n_error_16: { ++ state->error = 0xa; ++ state->reason = "Invalid header value char"; ++ state->error_pos = (const char*) p; ++ state->_current = (void*) (intptr_t) s_error; ++ return s_error; ++ /* UNREACHABLE */; ++ abort(); ++ } ++ s_n_llhttp__internal__n_invoke_test_flags_5: { ++ switch (llhttp__internal__c_test_flags_2(state, p, endp)) { ++ case 1: ++ goto s_n_llhttp__internal__n_header_value_discard_lws; ++ default: ++ goto s_n_llhttp__internal__n_error_16; ++ } ++ /* UNREACHABLE */; ++ abort(); ++ } + s_n_llhttp__internal__n_invoke_update_header_state_1: { ++ switch (llhttp__internal__c_update_header_state_1(state, p, endp)) { ++ default: ++ goto s_n_llhttp__internal__n_span_start_llhttp__on_header_value_1; ++ } ++ /* UNREACHABLE */; ++ abort(); ++ } ++ s_n_llhttp__internal__n_invoke_load_header_state_3: { ++ switch (llhttp__internal__c_load_header_state(state, p, endp)) { ++ case 8: ++ goto s_n_llhttp__internal__n_invoke_update_header_state_1; ++ default: ++ goto s_n_llhttp__internal__n_span_start_llhttp__on_header_value_1; ++ } ++ /* UNREACHABLE */; ++ abort(); ++ } ++ s_n_llhttp__internal__n_invoke_update_header_state_2: { + switch (llhttp__internal__c_update_header_state(state, p, endp)) { + default: + goto s_n_llhttp__internal__n_header_field_start; +@@ -12643,7 +12673,7 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_or_flags_7: { + switch (llhttp__internal__c_or_flags_3(state, p, endp)) { + default: +- goto s_n_llhttp__internal__n_invoke_update_header_state_1; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_2; + } + /* UNREACHABLE */; + abort(); +@@ -12651,7 +12681,7 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_or_flags_8: { + switch (llhttp__internal__c_or_flags_4(state, p, endp)) { + default: +- goto s_n_llhttp__internal__n_invoke_update_header_state_1; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_2; + } + /* UNREACHABLE */; + abort(); +@@ -12659,7 +12689,7 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_or_flags_9: { + switch (llhttp__internal__c_or_flags_5(state, p, endp)) { + default: +- goto s_n_llhttp__internal__n_invoke_update_header_state_1; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_2; + } + /* UNREACHABLE */; + abort(); +@@ -12672,7 +12702,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_load_header_state_3: { ++ s_n_llhttp__internal__n_invoke_load_header_state_4: { + switch (llhttp__internal__c_load_header_state(state, p, endp)) { + case 5: + goto s_n_llhttp__internal__n_invoke_or_flags_7; +@@ -12688,7 +12718,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_17: { ++ s_n_llhttp__internal__n_error_18: { + state->error = 0x3; + state->reason = "Missing expected LF after header value"; + state->error_pos = (const char*) p; +@@ -12759,35 +12789,25 @@ static llparse_state_t llhttp__internal_ + err = llhttp__on_header_value(state, start, p); + if (err != 0) { + state->error = err; +- state->error_pos = (const char*) (p + 1); +- state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_18; ++ state->error_pos = (const char*) p; ++ state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_19; + return s_error; + } +- p++; +- goto s_n_llhttp__internal__n_error_18; +- /* UNREACHABLE */; +- abort(); +- } +- s_n_llhttp__internal__n_error_19: { +- state->error = 0xa; +- state->reason = "Invalid header value char"; +- state->error_pos = (const char*) p; +- state->_current = (void*) (intptr_t) s_error; +- return s_error; ++ goto s_n_llhttp__internal__n_error_19; + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_test_flags_5: { ++ s_n_llhttp__internal__n_invoke_test_flags_6: { + switch (llhttp__internal__c_test_flags_2(state, p, endp)) { + case 1: + goto s_n_llhttp__internal__n_header_value_lenient; + default: +- goto s_n_llhttp__internal__n_header_value_lenient_failed; ++ goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_2; + } + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_update_header_state_3: { ++ s_n_llhttp__internal__n_invoke_update_header_state_4: { + switch (llhttp__internal__c_update_header_state(state, p, endp)) { + default: + goto s_n_llhttp__internal__n_header_value_connection; +@@ -12798,7 +12818,7 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_or_flags_11: { + switch (llhttp__internal__c_or_flags_3(state, p, endp)) { + default: +- goto s_n_llhttp__internal__n_invoke_update_header_state_3; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_4; + } + /* UNREACHABLE */; + abort(); +@@ -12806,7 +12826,7 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_or_flags_12: { + switch (llhttp__internal__c_or_flags_4(state, p, endp)) { + default: +- goto s_n_llhttp__internal__n_invoke_update_header_state_3; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_4; + } + /* UNREACHABLE */; + abort(); +@@ -12814,7 +12834,7 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_or_flags_13: { + switch (llhttp__internal__c_or_flags_5(state, p, endp)) { + default: +- goto s_n_llhttp__internal__n_invoke_update_header_state_3; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_4; + } + /* UNREACHABLE */; + abort(); +@@ -12827,7 +12847,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_load_header_state_4: { ++ s_n_llhttp__internal__n_invoke_load_header_state_5: { + switch (llhttp__internal__c_load_header_state(state, p, endp)) { + case 5: + goto s_n_llhttp__internal__n_invoke_or_flags_11; +@@ -12843,32 +12863,32 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_update_header_state_4: { +- switch (llhttp__internal__c_update_header_state_4(state, p, endp)) { ++ s_n_llhttp__internal__n_invoke_update_header_state_5: { ++ switch (llhttp__internal__c_update_header_state_1(state, p, endp)) { + default: + goto s_n_llhttp__internal__n_header_value_connection_token; + } + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_update_header_state_2: { +- switch (llhttp__internal__c_update_header_state_2(state, p, endp)) { ++ s_n_llhttp__internal__n_invoke_update_header_state_3: { ++ switch (llhttp__internal__c_update_header_state_3(state, p, endp)) { + default: + goto s_n_llhttp__internal__n_header_value_connection_ws; + } + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_update_header_state_5: { +- switch (llhttp__internal__c_update_header_state_5(state, p, endp)) { ++ s_n_llhttp__internal__n_invoke_update_header_state_6: { ++ switch (llhttp__internal__c_update_header_state_6(state, p, endp)) { + default: + goto s_n_llhttp__internal__n_header_value_connection_ws; + } + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_update_header_state_6: { +- switch (llhttp__internal__c_update_header_state_6(state, p, endp)) { ++ s_n_llhttp__internal__n_invoke_update_header_state_7: { ++ switch (llhttp__internal__c_update_header_state_7(state, p, endp)) { + default: + goto s_n_llhttp__internal__n_header_value_connection_ws; + } +@@ -12936,8 +12956,8 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_test_flags_6: { +- switch (llhttp__internal__c_test_flags_6(state, p, endp)) { ++ s_n_llhttp__internal__n_invoke_test_flags_7: { ++ switch (llhttp__internal__c_test_flags_7(state, p, endp)) { + case 0: + goto s_n_llhttp__internal__n_header_value_content_length; + default: +@@ -12964,8 +12984,8 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_update_header_state_7: { +- switch (llhttp__internal__c_update_header_state_7(state, p, endp)) { ++ s_n_llhttp__internal__n_invoke_update_header_state_8: { ++ switch (llhttp__internal__c_update_header_state_8(state, p, endp)) { + default: + goto s_n_llhttp__internal__n_header_value_otherwise; + } +@@ -12990,7 +13010,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_test_flags_8: { ++ s_n_llhttp__internal__n_invoke_test_flags_9: { + switch (llhttp__internal__c_test_flags_2(state, p, endp)) { + case 0: + goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_7; +@@ -13003,15 +13023,15 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_load_type_1: { + switch (llhttp__internal__c_load_type(state, p, endp)) { + case 1: +- goto s_n_llhttp__internal__n_invoke_test_flags_8; ++ goto s_n_llhttp__internal__n_invoke_test_flags_9; + default: + goto s_n_llhttp__internal__n_header_value_te_chunked; + } + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_update_header_state_8: { +- switch (llhttp__internal__c_update_header_state_4(state, p, endp)) { ++ s_n_llhttp__internal__n_invoke_update_header_state_9: { ++ switch (llhttp__internal__c_update_header_state_1(state, p, endp)) { + default: + goto s_n_llhttp__internal__n_header_value; + } +@@ -13034,7 +13054,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_test_flags_9: { ++ s_n_llhttp__internal__n_invoke_test_flags_10: { + switch (llhttp__internal__c_test_flags_2(state, p, endp)) { + case 0: + goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_8; +@@ -13047,7 +13067,7 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_load_type_2: { + switch (llhttp__internal__c_load_type(state, p, endp)) { + case 1: +- goto s_n_llhttp__internal__n_invoke_test_flags_9; ++ goto s_n_llhttp__internal__n_invoke_test_flags_10; + default: + goto s_n_llhttp__internal__n_invoke_or_flags_17; + } +@@ -13062,8 +13082,8 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_test_flags_7: { +- switch (llhttp__internal__c_test_flags_7(state, p, endp)) { ++ s_n_llhttp__internal__n_invoke_test_flags_8: { ++ switch (llhttp__internal__c_test_flags_8(state, p, endp)) { + case 1: + goto s_n_llhttp__internal__n_invoke_load_type_2; + default: +@@ -13075,7 +13095,7 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_or_flags_18: { + switch (llhttp__internal__c_or_flags_18(state, p, endp)) { + default: +- goto s_n_llhttp__internal__n_invoke_update_header_state_8; ++ goto s_n_llhttp__internal__n_invoke_update_header_state_9; + } + /* UNREACHABLE */; + abort(); +@@ -13085,9 +13105,9 @@ static llparse_state_t llhttp__internal_ + case 1: + goto s_n_llhttp__internal__n_header_value_connection; + case 2: +- goto s_n_llhttp__internal__n_invoke_test_flags_6; +- case 3: + goto s_n_llhttp__internal__n_invoke_test_flags_7; ++ case 3: ++ goto s_n_llhttp__internal__n_invoke_test_flags_8; + case 4: + goto s_n_llhttp__internal__n_invoke_or_flags_18; + default: +@@ -13141,8 +13161,8 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_update_header_state_9: { +- switch (llhttp__internal__c_update_header_state_4(state, p, endp)) { ++ s_n_llhttp__internal__n_invoke_update_header_state_10: { ++ switch (llhttp__internal__c_update_header_state_1(state, p, endp)) { + default: + goto s_n_llhttp__internal__n_header_field_general; + } +@@ -13157,8 +13177,8 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_invoke_update_header_state_10: { +- switch (llhttp__internal__c_update_header_state_4(state, p, endp)) { ++ s_n_llhttp__internal__n_invoke_update_header_state_11: { ++ switch (llhttp__internal__c_update_header_state_1(state, p, endp)) { + default: + goto s_n_llhttp__internal__n_header_field_general; + } +Index: node-v12.22.12/test/parallel/test-http-header-overflow.js +=================================================================== +--- node-v12.22.12.orig/test/parallel/test-http-header-overflow.js ++++ node-v12.22.12/test/parallel/test-http-header-overflow.js +@@ -8,7 +8,7 @@ const CRLF = '\r\n'; + const DUMMY_HEADER_NAME = 'Cookie: '; + const DUMMY_HEADER_VALUE = 'a'.repeat( + // Plus one is to make it 1 byte too big +- maxHeaderSize - DUMMY_HEADER_NAME.length - (2 * CRLF.length) + 1 ++ maxHeaderSize - DUMMY_HEADER_NAME.length + 2 + ); + const PAYLOAD_GET = 'GET /blah HTTP/1.1'; + const PAYLOAD = PAYLOAD_GET + CRLF + +@@ -21,7 +21,7 @@ server.on('connection', mustCall((socket + name: 'Error', + message: 'Parse Error: Header overflow', + code: 'HPE_HEADER_OVERFLOW', +- bytesParsed: maxHeaderSize + PAYLOAD_GET.length, ++ bytesParsed: maxHeaderSize + PAYLOAD_GET.length + (CRLF.length * 2) + 1, + rawPacket: Buffer.from(PAYLOAD) + })); + })); +Index: node-v12.22.12/test/parallel/test-http-missing-header-separator-cr.js +=================================================================== +--- node-v12.22.12.orig/test/parallel/test-http-missing-header-separator-cr.js ++++ node-v12.22.12/test/parallel/test-http-missing-header-separator-cr.js +@@ -6,21 +6,7 @@ const assert = require('assert'); + const http = require('http'); + const net = require('net'); + +-const msg = [ +- 'GET / HTTP/1.1', +- 'Host: localhost', +- 'Dummy: x\nContent-Length: 23', +- '', +- 'GET / HTTP/1.1', +- 'Dummy: GET /admin HTTP/1.1', +- 'Host: localhost', +- '', +- '', +-].join('\r\n'); +- +-const server = http.createServer(common.mustNotCall()); +- +-server.listen(0, common.mustSucceed(() => { ++function serverHandler(server, msg) { + const client = net.connect(server.address().port, 'localhost'); + + let response = ''; +@@ -40,4 +26,58 @@ server.listen(0, common.mustSucceed(() = + })); + client.write(msg); + client.resume(); +-})); ++} ++ ++{ ++ const msg = [ ++ 'GET / HTTP/1.1', ++ 'Host: localhost', ++ 'Dummy: x\nContent-Length: 23', ++ '', ++ 'GET / HTTP/1.1', ++ 'Dummy: GET /admin HTTP/1.1', ++ 'Host: localhost', ++ '', ++ '', ++ ].join('\r\n'); ++ ++ const server = http.createServer(common.mustNotCall()); ++ ++ server.listen(0, common.mustSucceed(serverHandler.bind(null, server, msg))); ++} ++ ++{ ++ const msg = [ ++ 'POST / HTTP/1.1', ++ 'Host: localhost', ++ 'x:x\nTransfer-Encoding: chunked', ++ '', ++ '1', ++ 'A', ++ '0', ++ '', ++ '', ++ ].join('\r\n'); ++ ++ const server = http.createServer(common.mustNotCall()); ++ ++ server.listen(0, common.mustSucceed(serverHandler.bind(null, server, msg))); ++} ++ ++{ ++ const msg = [ ++ 'POST / HTTP/1.1', ++ 'Host: localhost', ++ 'x:\nTransfer-Encoding: chunked', ++ '', ++ '1', ++ 'A', ++ '0', ++ '', ++ '', ++ ].join('\r\n'); ++ ++ const server = http.createServer(common.mustNotCall()); ++ ++ server.listen(0, common.mustSucceed(serverHandler.bind(null, server, msg))); ++} +Index: node-v12.22.12/test/parallel/test-http-transfer-encoding-smuggling.js +=================================================================== +--- node-v12.22.12.orig/test/parallel/test-http-transfer-encoding-smuggling.js ++++ node-v12.22.12/test/parallel/test-http-transfer-encoding-smuggling.js +@@ -6,47 +6,84 @@ const assert = require('assert'); + const http = require('http'); + const net = require('net'); + +-const msg = [ +- 'POST / HTTP/1.1', +- 'Host: 127.0.0.1', +- 'Transfer-Encoding: chunked', +- 'Transfer-Encoding: chunked-false', +- 'Connection: upgrade', +- '', +- '1', +- 'A', +- '0', +- '', +- 'GET /flag HTTP/1.1', +- 'Host: 127.0.0.1', +- '', +- '', +-].join('\r\n'); +- +-const server = http.createServer(common.mustNotCall((req, res) => { +- res.end(); +-}, 1)); +- +-server.listen(0, common.mustSucceed(() => { +- const client = net.connect(server.address().port, 'localhost'); +- +- let response = ''; +- +- // Verify that the server listener is never called +- +- client.on('data', common.mustCall((chunk) => { +- response += chunk.toString('utf-8'); ++{ ++ const msg = [ ++ 'POST / HTTP/1.1', ++ 'Host: 127.0.0.1', ++ 'Transfer-Encoding: chunked', ++ 'Transfer-Encoding: chunked-false', ++ 'Connection: upgrade', ++ '', ++ '1', ++ 'A', ++ '0', ++ '', ++ 'GET /flag HTTP/1.1', ++ 'Host: 127.0.0.1', ++ '', ++ '', ++ ].join('\r\n'); ++ ++ const server = http.createServer(common.mustNotCall((req, res) => { ++ res.end(); ++ }, 1)); ++ ++ server.listen(0, common.mustSucceed(() => { ++ const client = net.connect(server.address().port, 'localhost'); ++ ++ let response = ''; ++ ++ // Verify that the server listener is never called ++ ++ client.on('data', common.mustCall((chunk) => { ++ response += chunk.toString('utf-8'); ++ })); ++ ++ client.setEncoding('utf8'); ++ client.on('error', common.mustNotCall()); ++ client.on('end', common.mustCall(() => { ++ assert.strictEqual( ++ response, ++ 'HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n' ++ ); ++ server.close(); ++ })); ++ client.write(msg); ++ client.resume(); + })); ++} ++ ++{ ++ const msg = [ ++ 'POST / HTTP/1.1', ++ 'Host: 127.0.0.1', ++ 'Transfer-Encoding: chunked', ++ ' , chunked-false', ++ 'Connection: upgrade', ++ '', ++ '1', ++ 'A', ++ '0', ++ '', ++ 'GET /flag HTTP/1.1', ++ 'Host: 127.0.0.1', ++ '', ++ '', ++ ].join('\r\n'); ++ ++ const server = http.createServer(common.mustCall((request, response) => { ++ assert.notStrictEqual(request.url, '/admin'); ++ response.end('hello world'); ++ }), 1); ++ ++ server.listen(0, common.mustSucceed(() => { ++ const client = net.connect(server.address().port, 'localhost'); ++ ++ client.on('end', common.mustCall(function() { ++ server.close(); ++ })); + +- client.setEncoding('utf8'); +- client.on('error', common.mustNotCall()); +- client.on('end', common.mustCall(() => { +- assert.strictEqual( +- response, +- 'HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n' +- ); +- server.close(); ++ client.write(msg); ++ client.resume(); + })); +- client.write(msg); +- client.resume(); +-})); ++} diff --git a/CVE-2022-43548-pre-2.patch b/CVE-2022-43548-pre-2.patch deleted file mode 100644 index 5faf7d0f3bbda94b5bee2289136c04379f7f74e4..0000000000000000000000000000000000000000 --- a/CVE-2022-43548-pre-2.patch +++ /dev/null @@ -1,48 +0,0 @@ -From b358fb27a4253c6827378a64163448c04301e19c Mon Sep 17 00:00:00 2001 -From: RafaelGSS -Date: Wed, 13 Jul 2022 13:20:22 -0300 -Subject: [PATCH] src: fix IPv4 non routable validation -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Reviewed-By: Matteo Collina -Reviewed-By: James M Snell -Reviewed-By: Tobias Nießen -Reviewed-By: Juan José Arboleda -PR-URL: https://github.com/nodejs-private/node-private/pull/337 -CVE-ID: CVE-2022-32212, CVE-2018-7160 ---- - src/inspector_socket.cc | 1 + - test/cctest/test_inspector_socket.cc | 8 ++++++++ - 2 files changed, 9 insertions(+) - -diff --git a/src/inspector_socket.cc b/src/inspector_socket.cc -index 79b50e6a452d..ab1cdf1fa5bd 100644 ---- a/src/inspector_socket.cc -+++ b/src/inspector_socket.cc -@@ -164,6 +164,7 @@ static std::string TrimPort(const std::string& host) { - static bool IsIPAddress(const std::string& host) { - if (host.length() >= 4 && host.front() == '[' && host.back() == ']') - return true; -+ if (host.front() == '0') return false; - uint_fast16_t accum = 0; - uint_fast8_t quads = 0; - bool empty = true; -diff --git a/test/cctest/test_inspector_socket.cc b/test/cctest/test_inspector_socket.cc -index c740d961d9b7..6ae92c4b27e2 100644 ---- a/test/cctest/test_inspector_socket.cc -+++ b/test/cctest/test_inspector_socket.cc -@@ -925,4 +925,12 @@ TEST_F(InspectorSocketTest, HostIpTooManyOctetsChecked) { - expect_handshake_failure(); - } - -+TEST_F(InspectorSocketTest, HostIPNonRoutable) { -+ const std::string INVALID_HOST_IP_REQUEST = "GET /json HTTP/1.1\r\n" -+ "Host: 0.0.0.0:9229\r\n\r\n"; -+ send_in_chunks(INVALID_HOST_IP_REQUEST.c_str(), -+ INVALID_HOST_IP_REQUEST.length()); -+ expect_handshake_failure(); -+} -+ - } // anonymous namespace diff --git a/CVE-2022-43548.patch b/CVE-2022-43548.patch index 76172a37514e5530cdd473e16c9cade83d374f4d..2a18590816f2fa4573782c13a7715c1a11049169 100644 --- a/CVE-2022-43548.patch +++ b/CVE-2022-43548.patch @@ -19,11 +19,11 @@ Reviewed-by: Rich Trott test/cctest/test_inspector_socket.cc | 80 ++++++++++++++++++++++++++++ 2 files changed, 142 insertions(+), 16 deletions(-) -diff --git a/src/inspector_socket.cc b/src/inspector_socket.cc -index 8cabdaec2821..a28bd557c8ab 100644 ---- a/src/inspector_socket.cc -+++ b/src/inspector_socket.cc -@@ -6,6 +6,7 @@ +Index: node-v12.22.12/src/inspector_socket.cc +=================================================================== +--- node-v12.22.12.orig/src/inspector_socket.cc ++++ node-v12.22.12/src/inspector_socket.cc +@@ -10,6 +10,7 @@ #include "openssl/sha.h" // Sha-1 hash @@ -31,13 +31,12 @@ index 8cabdaec2821..a28bd557c8ab 100644 #include #include -@@ -162,25 +163,70 @@ static std::string TrimPort(const std::string& host) { +@@ -166,24 +167,70 @@ static std::string TrimPort(const std::s } static bool IsIPAddress(const std::string& host) { - if (host.length() >= 4 && host.front() == '[' && host.back() == ']') - return true; -- if (host.front() == '0') return false; - uint_fast16_t accum = 0; - uint_fast8_t quads = 0; - bool empty = true; @@ -118,11 +117,11 @@ index 8cabdaec2821..a28bd557c8ab 100644 } // Constants for hybi-10 frame format. -diff --git a/test/cctest/test_inspector_socket.cc b/test/cctest/test_inspector_socket.cc -index 6ae92c4b27e2..b351a23002c9 100644 ---- a/test/cctest/test_inspector_socket.cc -+++ b/test/cctest/test_inspector_socket.cc -@@ -925,6 +925,54 @@ TEST_F(InspectorSocketTest, HostIpTooManyOctetsChecked) { +Index: node-v12.22.12/test/cctest/test_inspector_socket.cc +=================================================================== +--- node-v12.22.12.orig/test/cctest/test_inspector_socket.cc ++++ node-v12.22.12/test/cctest/test_inspector_socket.cc +@@ -925,4 +925,85 @@ TEST_F(InspectorSocketTest, HostIpTooMan expect_handshake_failure(); } @@ -174,13 +173,7 @@ index 6ae92c4b27e2..b351a23002c9 100644 + expect_handshake_failure(); +} + - TEST_F(InspectorSocketTest, HostIPNonRoutable) { - const std::string INVALID_HOST_IP_REQUEST = "GET /json HTTP/1.1\r\n" - "Host: 0.0.0.0:9229\r\n\r\n"; -@@ -933,4 +981,36 @@ TEST_F(InspectorSocketTest, HostIPNonRoutable) { - expect_handshake_failure(); - } - ++ +TEST_F(InspectorSocketTest, HostIPv6NonRoutable) { + const std::string INVALID_HOST_IP_REQUEST = "GET /json HTTP/1.1\r\n" + "Host: [::]:9229\r\n\r\n"; diff --git a/CVE-2023-23918.patch b/CVE-2023-23918.patch new file mode 100644 index 0000000000000000000000000000000000000000..4f5037166c3fec374df3318b54ca907a06012cda --- /dev/null +++ b/CVE-2023-23918.patch @@ -0,0 +1,699 @@ +commit f7892c16be6507e26c2ae478c261fa3fa2d84f52 +Author: RafaelGSS +Date: Mon Feb 13 15:41:30 2023 -0300 + + lib: makeRequireFunction patch when experimental policy + + Signed-off-by: RafaelGSS + Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/373 + Refs: https://hackerone.com/bugs?subject=nodejs&report_id=1747642 + CVE-ID: CVE-2023-23918 + PR-URL: https://github.com/nodejs-private/node-private/pull/358 + Reviewed-by: Bradley Farias + Reviewed-by: Michael Dawson + +commit 83975b7fb463e29c92c8e83693b725e269cee149 +Author: RafaelGSS +Date: Tue Oct 25 00:23:27 2022 -0300 + + policy: makeRequireFunction on mainModule.require + + Signed-off-by: RafaelGSS + Co-authored-by: Bradley Farias + Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/373 + Refs: https://hackerone.com/bugs?subject=nodejs&report_id=1747642 + CVE-ID: CVE-2023-23918 + PR-URL: https://github.com/nodejs-private/node-private/pull/358 + Reviewed-by: Bradley Farias + Reviewed-by: Michael Dawson + +commit fa115ee8ac32883c96df4a93fafb600bd665a5aa +Author: Antoine du Hamel +Date: Fri Aug 5 00:41:48 2022 +0200 + + module: protect against prototype mutation + + Ensures that mutating the `Object` prototype does not influence the + parsing of `package.json` files. + + Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/373 + PR-URL: https://github.com/nodejs/node/pull/44007 + Reviewed-By: Geoffrey Booth + + +Index: node-v12.22.12/lib/internal/modules/cjs/helpers.js +=================================================================== +--- node-v12.22.12.orig/lib/internal/modules/cjs/helpers.js ++++ node-v12.22.12/lib/internal/modules/cjs/helpers.js +@@ -5,6 +5,7 @@ const { + SafeMap, + } = primordials; + const { ++ ERR_INVALID_ARG_TYPE, + ERR_MANIFEST_DEPENDENCY_MISSING, + ERR_UNKNOWN_BUILTIN_MODULE + } = require('internal/errors').codes; +@@ -14,11 +15,22 @@ const { validateString } = require('inte + const path = require('path'); + const { pathToFileURL, fileURLToPath } = require('internal/url'); + const { URL } = require('url'); ++const { setOwnProperty } = require('internal/util'); ++ ++const { ++ require_private_symbol, ++} = internalBinding('util'); + + let debug = require('internal/util/debuglog').debuglog('module', (fn) => { + debug = fn; + }); + ++// TODO: Use this set when resolving pkg#exports conditions in loader.js. ++const cjsConditions = [ ++ 'require', ++ 'node', ++]; ++ + function loadNativeModule(filename, request) { + const mod = NativeModule.map.get(filename); + if (mod) { +@@ -28,20 +40,31 @@ function loadNativeModule(filename, requ + } + } + ++let $Module = null; ++function lazyModule() { ++ $Module = $Module || require('internal/modules/cjs/loader').Module; ++ return $Module; ++} ++ + // Invoke with makeRequireFunction(module) where |module| is the Module object + // to use as the context for the require() function. + // Use redirects to set up a mapping from a policy and restrict dependencies + const urlToFileCache = new SafeMap(); + function makeRequireFunction(mod, redirects) { +- const Module = mod.constructor; ++ // lazy due to cycle ++ const Module = lazyModule(); ++ if (mod instanceof Module !== true) { ++ throw new ERR_INVALID_ARG_TYPE('mod', 'Module', mod); ++ } + + let require; + if (redirects) { + const { resolve, reaction } = redirects; + const id = mod.filename || mod.id; ++ const conditions = cjsConditions; + require = function require(path) { + let missing = true; +- const destination = resolve(path); ++ const destination = resolve(path, conditions); + if (destination === true) { + missing = false; + } else if (destination) { +@@ -61,17 +84,17 @@ function makeRequireFunction(mod, redire + filepath = fileURLToPath(destination); + urlToFileCache.set(href, filepath); + } +- return mod.require(filepath); ++ return mod[require_private_symbol](mod, filepath); + } + } + if (missing) { +- reaction(new ERR_MANIFEST_DEPENDENCY_MISSING(id, path)); ++ reaction(new ERR_MANIFEST_DEPENDENCY_MISSING(id, path, ArrayPrototypeJoin([...conditions], ', '))); + } +- return mod.require(path); ++ return mod[require_private_symbol](mod, path); + }; + } else { + require = function require(path) { +- return mod.require(path); ++ return mod[require_private_symbol](mod, path); + }; + } + +@@ -89,7 +112,7 @@ function makeRequireFunction(mod, redire + + resolve.paths = paths; + +- require.main = process.mainModule; ++ setOwnProperty(require, 'main', process.mainModule); + + // Enable support to add extra extension types. + require.extensions = Module._extensions; +Index: node-v12.22.12/lib/internal/modules/cjs/loader.js +=================================================================== +--- node-v12.22.12.orig/lib/internal/modules/cjs/loader.js ++++ node-v12.22.12/lib/internal/modules/cjs/loader.js +@@ -59,7 +59,7 @@ const { + rekeySourceMap + } = require('internal/source_map/source_map_cache'); + const { pathToFileURL, fileURLToPath, isURLInstance } = require('internal/url'); +-const { deprecate } = require('internal/util'); ++const { deprecate, filterOwnProperties, setOwnProperty } = require('internal/util'); + const vm = require('vm'); + const assert = require('internal/assert'); + const fs = require('fs'); +@@ -70,6 +70,9 @@ const { internalModuleStat } = internalB + const packageJsonReader = require('internal/modules/package_json_reader'); + const { safeGetenv } = internalBinding('credentials'); + const { ++ require_private_symbol, ++} = internalBinding('util'); ++const { + makeRequireFunction, + normalizeReferrerURL, + stripBOM, +@@ -120,6 +123,20 @@ const relativeResolveCache = ObjectCreat + let requireDepth = 0; + let statCache = null; + ++function internalRequire(module, id) { ++ validateString(id, 'id'); ++ if (id === '') { ++ throw new ERR_INVALID_ARG_VALUE('id', id, ++ 'must be a non-empty string'); ++ } ++ requireDepth++; ++ try { ++ return Module._load(id, module, /* isMain */ false); ++ } finally { ++ requireDepth--; ++ } ++} ++ + function stat(filename) { + filename = path.toNamespacedPath(filename); + if (statCache !== null) { +@@ -140,12 +157,21 @@ function updateChildren(parent, child, s + function Module(id = '', parent) { + this.id = id; + this.path = path.dirname(id); +- this.exports = {}; ++ setOwnProperty(this, 'exports', {}); + this.parent = parent; + updateChildren(parent, this, false); + this.filename = null; + this.loaded = false; + this.children = []; ++ let redirects; ++ if (manifest) { ++ const moduleURL = pathToFileURL(id); ++ redirects = manifest.getRedirector(moduleURL); ++ } ++ setOwnProperty(this, 'require', makeRequireFunction(this, redirects)); ++ // Loads a module at the given file path. Returns that module's ++ // `exports` property. ++ this[require_private_symbol] = internalRequire; + } + + const builtinModules = []; +@@ -242,14 +268,13 @@ function readPackage(requestPath) { + } + + try { +- const parsed = JSONParse(json); +- const filtered = { +- name: parsed.name, +- main: parsed.main, +- exports: parsed.exports, +- imports: parsed.imports, +- type: parsed.type +- }; ++ const filtered = filterOwnProperties(JSONParse(json), [ ++ 'name', ++ 'main', ++ 'exports', ++ 'imports', ++ 'type', ++ ]); + packageJsonCache.set(jsonPath, filtered); + return filtered; + } catch (e) { +@@ -684,6 +709,7 @@ Module._load = function(request, parent, + + if (isMain) { + process.mainModule = module; ++ setOwnProperty(module.require, 'main', process.mainModule); + module.id = '.'; + } + +@@ -873,24 +899,6 @@ Module.prototype.load = function(filenam + ESMLoader.cjsCache.set(this, exports); + }; + +- +-// Loads a module at the given file path. Returns that module's +-// `exports` property. +-Module.prototype.require = function(id) { +- validateString(id, 'id'); +- if (id === '') { +- throw new ERR_INVALID_ARG_VALUE('id', id, +- 'must be a non-empty string'); +- } +- requireDepth++; +- try { +- return Module._load(id, this, /* isMain */ false); +- } finally { +- requireDepth--; +- } +-}; +- +- + // Resolved path to process.argv[1] will be lazily placed here + // (needed for setting breakpoint when called with --inspect-brk) + let resolvedArgv; +@@ -952,10 +960,9 @@ function wrapSafe(filename, content, cjs + // Returns exception, if any. + Module.prototype._compile = function(content, filename) { + let moduleURL; +- let redirects; + if (manifest) { + moduleURL = pathToFileURL(filename); +- redirects = manifest.getRedirector(moduleURL); ++ manifest.getRedirector(moduleURL); + manifest.assertIntegrity(moduleURL, content); + } + +@@ -986,7 +993,6 @@ Module.prototype._compile = function(con + } + } + const dirname = path.dirname(filename); +- const require = makeRequireFunction(this, redirects); + let result; + const exports = this.exports; + const thisValue = exports; +@@ -994,9 +1000,9 @@ Module.prototype._compile = function(con + if (requireDepth === 0) statCache = new Map(); + if (inspectorWrapper) { + result = inspectorWrapper(compiledWrapper, thisValue, exports, +- require, module, filename, dirname); ++ module.require, module, filename, dirname); + } else { +- result = compiledWrapper.call(thisValue, exports, require, module, ++ result = compiledWrapper.call(thisValue, exports, module.require, module, + filename, dirname); + } + hasLoadedAnyUserCJSModule = true; +@@ -1038,7 +1044,7 @@ Module._extensions['.json'] = function(m + } + + try { +- module.exports = JSONParse(stripBOM(content)); ++ setOwnProperty(module, 'exports', JSONParse(stripBOM(content))); + } catch (err) { + err.message = filename + ': ' + err.message; + throw err; +@@ -1144,7 +1150,7 @@ Module._preloadModules = function(reques + } + } + for (let n = 0; n < requests.length; n++) +- parent.require(requests[n]); ++ internalRequire(parent, requests[n]); + }; + + Module.syncBuiltinESMExports = function syncBuiltinESMExports() { +@@ -1155,5 +1161,14 @@ Module.syncBuiltinESMExports = function + } + }; + ++ObjectDefineProperty(Module.prototype, 'constructor', { ++ __proto__: null, ++ get: function() { ++ return policy ? undefined : Module; ++ }, ++ configurable: false, ++ enumerable: false, ++}); ++ + // Backwards compatibility + Module.Module = Module; +Index: node-v12.22.12/lib/internal/util.js +=================================================================== +--- node-v12.22.12.orig/lib/internal/util.js ++++ node-v12.22.12/lib/internal/util.js +@@ -11,6 +11,7 @@ const { + ObjectGetOwnPropertyDescriptor, + ObjectGetOwnPropertyDescriptors, + ObjectGetPrototypeOf, ++ ObjectPrototypeHasOwnProperty, + ObjectSetPrototypeOf, + Promise, + ReflectConstruct, +@@ -404,6 +405,35 @@ function sleep(msec) { + _sleep(msec); + } + ++function filterOwnProperties(source, keys) { ++ const filtered = ObjectCreate(null); ++ for (let i = 0; i < keys.length; i++) { ++ const key = keys[i]; ++ if (ObjectPrototypeHasOwnProperty(source, key)) { ++ filtered[key] = source[key]; ++ } ++ } ++ ++ return filtered; ++} ++ ++/** ++ * Mimics `obj[key] = value` but ignoring potential prototype inheritance. ++ * @param {any} obj ++ * @param {string} key ++ * @param {any} value ++ * @returns {any} ++ */ ++function setOwnProperty(obj, key, value) { ++ return ObjectDefineProperty(obj, key, { ++ __proto__: null, ++ configurable: true, ++ enumerable: true, ++ value, ++ writable: true, ++ }); ++} ++ + module.exports = { + assertCrypto, + cachedResult, +@@ -413,6 +443,7 @@ module.exports = { + deprecate, + emitExperimentalWarning, + filterDuplicateStrings, ++ filterOwnProperties, + getConstructorOf, + getSystemErrorName, + isError, +@@ -435,5 +466,6 @@ module.exports = { + // Used by the buffer module to capture an internal reference to the + // default isEncoding implementation, just in case userland overrides it. + kIsEncodingSymbol: Symbol('kIsEncodingSymbol'), +- kVmBreakFirstLineSymbol: Symbol('kVmBreakFirstLineSymbol') ++ kVmBreakFirstLineSymbol: Symbol('kVmBreakFirstLineSymbol'), ++ setOwnProperty, + }; +Index: node-v12.22.12/test/common/fixtures.js +=================================================================== +--- node-v12.22.12.orig/test/common/fixtures.js ++++ node-v12.22.12/test/common/fixtures.js +@@ -3,6 +3,7 @@ + + const path = require('path'); + const fs = require('fs'); ++const { pathToFileURL } = require('url'); + + const fixturesDir = path.join(__dirname, '..', 'fixtures'); + +@@ -10,6 +11,10 @@ function fixturesPath(...args) { + return path.join(fixturesDir, ...args); + } + ++function fixturesFileURL(...args) { ++ return pathToFileURL(fixturesPath(...args)); ++} ++ + function readFixtureSync(args, enc) { + if (Array.isArray(args)) + return fs.readFileSync(fixturesPath(...args), enc); +@@ -23,6 +28,7 @@ function readFixtureKey(name, enc) { + module.exports = { + fixturesDir, + path: fixturesPath, ++ fileURL: fixturesFileURL, + readSync: readFixtureSync, + readKey: readFixtureKey + }; +Index: node-v12.22.12/test/fixtures/es-module-specifiers/index.mjs +=================================================================== +--- node-v12.22.12.orig/test/fixtures/es-module-specifiers/index.mjs ++++ node-v12.22.12/test/fixtures/es-module-specifiers/index.mjs +@@ -1,10 +1,11 @@ + import explicit from 'explicit-main'; + import implicit from 'implicit-main'; + import implicitModule from 'implicit-main-type-module'; ++import noMain from 'no-main-field'; + + function getImplicitCommonjs () { + return import('implicit-main-type-commonjs'); + } + +-export {explicit, implicit, implicitModule, getImplicitCommonjs}; ++export {explicit, implicit, implicitModule, getImplicitCommonjs, noMain}; + export default 'success'; +Index: node-v12.22.12/test/fixtures/es-module-specifiers/node_modules/no-main-field/index.js +=================================================================== +--- /dev/null ++++ node-v12.22.12/test/fixtures/es-module-specifiers/node_modules/no-main-field/index.js +@@ -0,0 +1,3 @@ ++'use strict'; ++module.exports = 'no main field'; ++ +Index: node-v12.22.12/test/fixtures/es-module-specifiers/node_modules/no-main-field/package.json +=================================================================== +--- /dev/null ++++ node-v12.22.12/test/fixtures/es-module-specifiers/node_modules/no-main-field/package.json +@@ -0,0 +1 @@ ++{} +Index: node-v12.22.12/test/parallel/test-module-prototype-mutation.js +=================================================================== +--- /dev/null ++++ node-v12.22.12/test/parallel/test-module-prototype-mutation.js +@@ -0,0 +1,13 @@ ++'use strict'; ++const common = require('../common'); ++const fixtures = require('../common/fixtures'); ++const assert = require('assert'); ++ ++assert.strictEqual( ++ require(fixtures.path('es-module-specifiers', 'node_modules', 'no-main-field')), ++ 'no main field' ++); ++ ++import(fixtures.fileURL('es-module-specifiers', 'index.mjs')) ++ .then(common.mustCall((module) => assert.strictEqual(module.noMain, 'no main field'))); ++ +Index: node-v12.22.12/test/message/source_map_throw_catch.out +=================================================================== +--- node-v12.22.12.orig/test/message/source_map_throw_catch.out ++++ node-v12.22.12/test/message/source_map_throw_catch.out +@@ -8,7 +8,7 @@ Error: an exception + at Object.Module._extensions..js (internal/modules/cjs/loader.js:*) + at Module.load (internal/modules/cjs/loader.js:*) + at Function.Module._load (internal/modules/cjs/loader.js:*) +- at Module.require (internal/modules/cjs/loader.js:*) ++ at Module.internalRequire (internal/modules/cjs/loader.js:*) + at require (internal/modules/cjs/helpers.js:*) + at Object. (*source_map_throw_catch.js:6:3) + at Module._compile (internal/modules/cjs/loader.js:*) +Index: node-v12.22.12/test/message/source_map_throw_first_tick.out +=================================================================== +--- node-v12.22.12.orig/test/message/source_map_throw_first_tick.out ++++ node-v12.22.12/test/message/source_map_throw_first_tick.out +@@ -8,7 +8,7 @@ Error: an exception + at Object.Module._extensions..js (internal/modules/cjs/loader.js:*) + at Module.load (internal/modules/cjs/loader.js:*) + at Function.Module._load (internal/modules/cjs/loader.js:*) +- at Module.require (internal/modules/cjs/loader.js:*) ++ at Module.internalRequire (internal/modules/cjs/loader.js:*) + at require (internal/modules/cjs/helpers.js:*) + at Object. (*source_map_throw_first_tick.js:5:1) + at Module._compile (internal/modules/cjs/loader.js:*) +Index: node-v12.22.12/src/env.h +=================================================================== +--- node-v12.22.12.orig/src/env.h ++++ node-v12.22.12/src/env.h +@@ -161,6 +161,7 @@ constexpr size_t kFsStatsBufferLength = + V(napi_wrapper, "node:napi:wrapper") \ + V(sab_lifetimepartner_symbol, "node:sharedArrayBufferLifetimePartner") \ + V(untransferable_object_private_symbol, "node:untransferableObject") \ ++ V(require_private_symbol, "node:require_private_symbol") + + // Symbols are per-isolate primitives but Environment proxies them + // for the sake of convenience. +Index: node-v12.22.12/test/fixtures/policy-manifest/object-define-property-bypass.js +=================================================================== +--- /dev/null ++++ node-v12.22.12/test/fixtures/policy-manifest/object-define-property-bypass.js +@@ -0,0 +1,19 @@ ++let requires = new WeakMap() ++Object.defineProperty(Object.getPrototypeOf(module), 'require', { ++ get() { ++ return requires.get(this); ++ }, ++ set(v) { ++ requires.set(this, v); ++ process.nextTick(() => { ++ let fs = Reflect.apply(v, this, ['fs']) ++ if (typeof fs.readFileSync === 'function') { ++ process.exit(1); ++ } ++ }) ++ return requires.get(this); ++ }, ++ configurable: true ++}) ++ ++require('./valid-module') +Index: node-v12.22.12/test/fixtures/policy-manifest/onerror-exit.json +=================================================================== +--- /dev/null ++++ node-v12.22.12/test/fixtures/policy-manifest/onerror-exit.json +@@ -0,0 +1,9 @@ ++{ ++ "onerror": "exit", ++ "scopes": { ++ "file:": { ++ "integrity": true, ++ "dependencies": {} ++ } ++ } ++} +Index: node-v12.22.12/test/fixtures/policy-manifest/onerror-resource-exit.json +=================================================================== +--- /dev/null ++++ node-v12.22.12/test/fixtures/policy-manifest/onerror-resource-exit.json +@@ -0,0 +1,17 @@ ++{ ++ "onerror": "exit", ++ "resources": { ++ "./object-define-property-bypass.js": { ++ "integrity": true, ++ "dependencies": { ++ "./valid-module": true ++ } ++ }, ++ "./valid-module.js": { ++ "integrity": true, ++ "dependencies": { ++ "fs": true ++ } ++ } ++ } ++} +Index: node-v12.22.12/test/parallel/test-policy-manifest.js +=================================================================== +--- /dev/null ++++ node-v12.22.12/test/parallel/test-policy-manifest.js +@@ -0,0 +1,63 @@ ++'use strict'; ++ ++const common = require('../common'); ++ ++if (!common.hasCrypto) ++ common.skip('missing crypto'); ++ ++common.requireNoPackageJSONAbove(); ++ ++const assert = require('assert'); ++const { spawnSync } = require('child_process'); ++const fixtures = require('../common/fixtures.js'); ++ ++{ ++ const policyFilepath = fixtures.path('policy-manifest', 'onerror-exit.json'); ++ const result = spawnSync(process.execPath, [ ++ '--experimental-policy', ++ policyFilepath, ++ '-e', ++ 'require("os").cpus()', ++ ]); ++ ++ assert.notStrictEqual(result.status, 0); ++ const stderr = result.stderr.toString(); ++ assert.match(stderr, /ERR_MANIFEST_ASSERT_INTEGRITY/); ++ assert.match(stderr, /The resource was not found in the policy/); ++} ++ ++{ ++ const policyFilepath = fixtures.path('policy-manifest', 'onerror-exit.json'); ++ const mainModuleBypass = fixtures.path( ++ 'policy-manifest', ++ 'main-module-bypass.js', ++ ); ++ const result = spawnSync(process.execPath, [ ++ '--experimental-policy', ++ policyFilepath, ++ mainModuleBypass, ++ ]); ++ ++ assert.notStrictEqual(result.status, 0); ++ const stderr = result.stderr.toString(); ++ assert.match(stderr, /ERR_MANIFEST_ASSERT_INTEGRITY/); ++ assert.match(stderr, /The resource was not found in the policy/); ++} ++ ++{ ++ const policyFilepath = fixtures.path( ++ 'policy-manifest', ++ 'onerror-resource-exit.json', ++ ); ++ const objectDefinePropertyBypass = fixtures.path( ++ 'policy-manifest', ++ 'object-define-property-bypass.js', ++ ); ++ const result = spawnSync(process.execPath, [ ++ '--experimental-policy', ++ policyFilepath, ++ objectDefinePropertyBypass, ++ ]); ++ ++ assert.strictEqual(result.status, 0); ++} +Index: node-v12.22.12/test/common/index.js +=================================================================== +--- node-v12.22.12.orig/test/common/index.js ++++ node-v12.22.12/test/common/index.js +@@ -710,6 +710,20 @@ function gcUntil(name, condition) { + }); + } + ++function requireNoPackageJSONAbove(dir = __dirname) { ++ let possiblePackage = path.join(dir, '..', 'package.json'); ++ let lastPackage = null; ++ while (possiblePackage !== lastPackage) { ++ if (fs.existsSync(possiblePackage)) { ++ assert.fail( ++ 'This test shouldn\'t load properties from a package.json above ' + ++ `its file location. Found package.json at ${possiblePackage}.`); ++ } ++ lastPackage = possiblePackage; ++ possiblePackage = path.join(possiblePackage, '..', '..', 'package.json'); ++ } ++} ++ + const common = { + allowGlobals, + buildType, +@@ -751,6 +765,7 @@ const common = { + platformTimeout, + printSkipMessage, + pwdCommand, ++ requireNoPackageJSONAbove, + runWithInvalidFD, + skip, + skipIf32Bits, +Index: node-v12.22.12/lib/internal/policy/manifest.js +=================================================================== +--- node-v12.22.12.orig/lib/internal/policy/manifest.js ++++ node-v12.22.12/lib/internal/policy/manifest.js +@@ -115,7 +115,7 @@ class Manifest { + } + + this.#reaction = reaction; +- const manifestEntries = ObjectEntries(obj.resources); ++ const manifestEntries = ObjectEntries(obj.resources ? obj.resources : ObjectCreate(null)); + + const parsedURLs = new SafeMap(); + for (let i = 0; i < manifestEntries.length; i++) { +Index: node-v12.22.12/test/fixtures/policy-manifest/valid-module.js +=================================================================== +--- /dev/null ++++ node-v12.22.12/test/fixtures/policy-manifest/valid-module.js +@@ -0,0 +1,2 @@ ++ ++ +Index: node-v12.22.12/test/fixtures/policy-manifest/main-module-bypass.js +=================================================================== +--- /dev/null ++++ node-v12.22.12/test/fixtures/policy-manifest/main-module-bypass.js +@@ -0,0 +1 @@ ++process.mainModule.require('os').cpus(); diff --git a/CVE-2023-23920.patch b/CVE-2023-23920.patch new file mode 100644 index 0000000000000000000000000000000000000000..521db2c8cb993f5c1aa9efade564466e4af3972f --- /dev/null +++ b/CVE-2023-23920.patch @@ -0,0 +1,28 @@ +commit 97a0443f1369e65cf656a529b2f5433bfd56ad92 +Author: RafaelGSS +Date: Wed Jan 18 17:37:37 2023 -0300 + + build: build ICU with ICU_NO_USER_DATA_OVERRIDE + + CVE-ID: CVE-2023-23920 + Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/377 + PR-URL: https://github.com/nodejs-private/node-private/pull/374 + Refs: https://hackerone.com/bugs?subject=nodejs&report_id=1625036 + Reviewed-By: Ben Noordhuis + Reviewed-By: Richard Lau + Reviewed-By: Michael Dawson + +diff --git a/configure.py b/configure.py +index 892e1d4202..9a75dbb76d 100755 +--- a/configure.py ++++ b/configure.py +@@ -1487,6 +1487,9 @@ def configure_intl(o): + # always set icu_small, node.gyp depends on it being defined. + o['variables']['icu_small'] = b(False) + ++ # prevent data override ++ o['defines'] += ['ICU_NO_USER_DATA_OVERRIDE'] ++ + with_intl = options.with_intl + with_icu_source = options.with_icu_source + have_icu_path = bool(options.with_icu_path) diff --git a/CVE-2023-30581.patch b/CVE-2023-30581.patch new file mode 100644 index 0000000000000000000000000000000000000000..f77fd50d479b39c8885d7c1ef5fc87d12ea48972 --- /dev/null +++ b/CVE-2023-30581.patch @@ -0,0 +1,62 @@ +commit a6f4e87bc913ff18c1859b8a350c24f744355e66 +Author: RafaelGSS +Date: Mon May 29 16:40:15 2023 -0300 + + policy: handle mainModule.__proto__ bypass + + Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/418 + PR-URL: https://github.com/nodejs-private/node-private/pull/416 + Fixes: https://hackerone.com/bugs?subject=nodejs&report_id=1877919 + Reviewed-By: Rich Trott + CVE-ID: CVE-2023-30581 + +Index: node-v12.22.12/lib/internal/modules/cjs/loader.js +=================================================================== +--- node-v12.22.12.orig/lib/internal/modules/cjs/loader.js ++++ node-v12.22.12/lib/internal/modules/cjs/loader.js +@@ -167,6 +167,7 @@ function Module(id = '', parent) { + if (manifest) { + const moduleURL = pathToFileURL(id); + redirects = manifest.getRedirector(moduleURL); ++ setOwnProperty(this.__proto__, 'require', makeRequireFunction(this, redirects)); + } + setOwnProperty(this, 'require', makeRequireFunction(this, redirects)); + // Loads a module at the given file path. Returns that module's +@@ -708,7 +709,7 @@ Module._load = function(request, parent, + const module = cachedModule || new Module(filename, parent); + + if (isMain) { +- process.mainModule = module; ++ setOwnProperty(process, 'mainModule', module); + setOwnProperty(module.require, 'main', process.mainModule); + module.id = '.'; + } +Index: node-v12.22.12/test/fixtures/policy-manifest/main-module-proto-bypass.js +=================================================================== +--- /dev/null ++++ node-v12.22.12/test/fixtures/policy-manifest/main-module-proto-bypass.js +@@ -0,0 +1 @@ ++process.mainModule.__proto__.require("os") +Index: node-v12.22.12/test/parallel/test-policy-manifest.js +=================================================================== +--- node-v12.22.12.orig/test/parallel/test-policy-manifest.js ++++ node-v12.22.12/test/parallel/test-policy-manifest.js +@@ -61,3 +61,18 @@ const fixtures = require('../common/fixt + + assert.strictEqual(result.status, 0); + } ++{ ++ const policyFilepath = fixtures.path('policy-manifest', 'onerror-exit.json'); ++ const mainModuleBypass = fixtures.path('policy-manifest', 'main-module-proto-bypass.js'); ++ const result = spawnSync(process.execPath, [ ++ '--experimental-policy', ++ policyFilepath, ++ mainModuleBypass, ++ ]); ++ ++ assert.notStrictEqual(result.status, 0); ++ const stderr = result.stderr.toString(); ++ assert.match(stderr, /ERR_MANIFEST_ASSERT_INTEGRITY/); ++ assert.match(stderr, /The resource was not found in the policy/); ++} ++ diff --git a/CVE-2023-30589.patch b/CVE-2023-30589.patch new file mode 100644 index 0000000000000000000000000000000000000000..970872275aac22b43ca99ed6caa9b81fee5556e0 --- /dev/null +++ b/CVE-2023-30589.patch @@ -0,0 +1,2700 @@ +commit e42ff4b0180f4e0f5712364dd6ea015559640152 +Author: Paolo Insogna +Date: Tue Jun 13 12:06:27 2023 +0200 + + http: disable request smuggling via empty headers + + PR-URL: https://github.com/nodejs-private/node-private/pull/429 + Refs: https://github.com/nodejs-private/node-private/pull/427 + Reviewed-By: Rafael Gonzaga + Reviewed-By: Matteo Collina + CVE-ID: CVE-2023-30589 + +Index: node-v14.21.3/test/parallel/test-http-missing-header-separator-lf.js +=================================================================== +--- /dev/null ++++ node-v14.21.3/test/parallel/test-http-missing-header-separator-lf.js +@@ -0,0 +1,83 @@ ++'use strict'; ++ ++const common = require('../common'); ++const assert = require('assert'); ++ ++const http = require('http'); ++const net = require('net'); ++ ++function serverHandler(server, msg) { ++ const client = net.connect(server.address().port, 'localhost'); ++ ++ let response = ''; ++ ++ client.on('data', common.mustCall((chunk) => { ++ response += chunk; ++ })); ++ ++ client.setEncoding('utf8'); ++ client.on('error', common.mustNotCall()); ++ client.on('end', common.mustCall(() => { ++ assert.strictEqual( ++ response, ++ 'HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n' ++ ); ++ server.close(); ++ })); ++ client.write(msg); ++ client.resume(); ++} ++ ++{ ++ const msg = [ ++ 'GET / HTTP/1.1', ++ 'Host: localhost', ++ 'Dummy: x\rContent-Length: 23', ++ '', ++ 'GET / HTTP/1.1', ++ 'Dummy: GET /admin HTTP/1.1', ++ 'Host: localhost', ++ '', ++ '', ++ ].join('\r\n'); ++ ++ const server = http.createServer(common.mustNotCall()); ++ ++ server.listen(0, common.mustSucceed(serverHandler.bind(null, server, msg))); ++} ++ ++{ ++ const msg = [ ++ 'POST / HTTP/1.1', ++ 'Host: localhost', ++ 'x:x\rTransfer-Encoding: chunked', ++ '', ++ '1', ++ 'A', ++ '0', ++ '', ++ '', ++ ].join('\r\n'); ++ ++ const server = http.createServer(common.mustNotCall()); ++ ++ server.listen(0, common.mustSucceed(serverHandler.bind(null, server, msg))); ++} ++ ++{ ++ const msg = [ ++ 'POST / HTTP/1.1', ++ 'Host: localhost', ++ 'x:\rTransfer-Encoding: chunked', ++ '', ++ '1', ++ 'A', ++ '0', ++ '', ++ '', ++ ].join('\r\n'); ++ ++ const server = http.createServer(common.mustNotCall()); ++ ++ server.listen(0, common.mustSucceed(serverHandler.bind(null, server, msg))); ++} +Index: node-v14.21.3/deps/llhttp/src/llhttp.c +=================================================================== +--- node-v14.21.3.orig/deps/llhttp/src/llhttp.c ++++ node-v14.21.3/deps/llhttp/src/llhttp.c +@@ -325,7 +325,7 @@ enum llparse_state_e { + s_n_llhttp__internal__n_header_value_lws, + s_n_llhttp__internal__n_header_value_almost_done, + s_n_llhttp__internal__n_header_value_lenient, +- s_n_llhttp__internal__n_error_25, ++ s_n_llhttp__internal__n_error_26, + s_n_llhttp__internal__n_header_value_otherwise, + s_n_llhttp__internal__n_header_value_connection_token, + s_n_llhttp__internal__n_header_value_connection_ws, +@@ -333,12 +333,12 @@ enum llparse_state_e { + s_n_llhttp__internal__n_header_value_connection_2, + s_n_llhttp__internal__n_header_value_connection_3, + s_n_llhttp__internal__n_header_value_connection, +- s_n_llhttp__internal__n_error_27, + s_n_llhttp__internal__n_error_28, ++ s_n_llhttp__internal__n_error_29, + s_n_llhttp__internal__n_header_value_content_length_ws, + s_n_llhttp__internal__n_header_value_content_length, ++ s_n_llhttp__internal__n_error_31, + s_n_llhttp__internal__n_error_30, +- s_n_llhttp__internal__n_error_29, + s_n_llhttp__internal__n_header_value_te_token_ows, + s_n_llhttp__internal__n_header_value, + s_n_llhttp__internal__n_header_value_te_token, +@@ -1540,11 +1540,11 @@ static llparse_state_t llhttp__internal_ + switch (*p) { + case 9: { + p++; +- goto s_n_llhttp__internal__n_header_value_discard_ws; ++ goto s_n_llhttp__internal__n_error_22; + } + case ' ': { + p++; +- goto s_n_llhttp__internal__n_header_value_discard_ws; ++ goto s_n_llhttp__internal__n_error_22; + } + default: { + goto s_n_llhttp__internal__n_invoke_load_header_state; +@@ -1564,7 +1564,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_header_value_discard_lws; + } + default: { +- goto s_n_llhttp__internal__n_error_23; ++ goto s_n_llhttp__internal__n_error_24; + } + } + /* UNREACHABLE */; +@@ -1600,7 +1600,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_header_value_lws; + } + default: { +- goto s_n_llhttp__internal__n_error_24; ++ goto s_n_llhttp__internal__n_error_25; + } + } + /* UNREACHABLE */; +@@ -1626,8 +1626,8 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- case s_n_llhttp__internal__n_error_25: +- s_n_llhttp__internal__n_error_25: { ++ case s_n_llhttp__internal__n_error_26: ++ s_n_llhttp__internal__n_error_26: { + state->error = 0xa; + state->reason = "Invalid header value char"; + state->error_pos = (const char*) p; +@@ -1823,8 +1823,8 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- case s_n_llhttp__internal__n_error_27: +- s_n_llhttp__internal__n_error_27: { ++ case s_n_llhttp__internal__n_error_28: ++ s_n_llhttp__internal__n_error_28: { + state->error = 0xb; + state->reason = "Content-Length overflow"; + state->error_pos = (const char*) p; +@@ -1833,8 +1833,8 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- case s_n_llhttp__internal__n_error_28: +- s_n_llhttp__internal__n_error_28: { ++ case s_n_llhttp__internal__n_error_29: ++ s_n_llhttp__internal__n_error_29: { + state->error = 0xb; + state->reason = "Invalid character in Content-Length"; + state->error_pos = (const char*) p; +@@ -1929,8 +1929,8 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- case s_n_llhttp__internal__n_error_30: +- s_n_llhttp__internal__n_error_30: { ++ case s_n_llhttp__internal__n_error_31: ++ s_n_llhttp__internal__n_error_31: { + state->error = 0xf; + state->reason = "Invalid `Transfer-Encoding` header value"; + state->error_pos = (const char*) p; +@@ -1939,8 +1939,8 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- case s_n_llhttp__internal__n_error_29: +- s_n_llhttp__internal__n_error_29: { ++ case s_n_llhttp__internal__n_error_30: ++ s_n_llhttp__internal__n_error_30: { + state->error = 0xf; + state->reason = "Invalid `Transfer-Encoding` header value"; + state->error_pos = (const char*) p; +@@ -2168,7 +2168,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_span_end_llhttp__on_header_field_2; + } + default: { +- goto s_n_llhttp__internal__n_error_31; ++ goto s_n_llhttp__internal__n_error_32; + } + } + /* UNREACHABLE */; +@@ -2548,7 +2548,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_to_http_09; + } + default: { +- goto s_n_llhttp__internal__n_error_32; ++ goto s_n_llhttp__internal__n_error_33; + } + } + /* UNREACHABLE */; +@@ -2573,7 +2573,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_skip_lf_to_http09_1; + } + default: { +- goto s_n_llhttp__internal__n_error_32; ++ goto s_n_llhttp__internal__n_error_33; + } + } + /* UNREACHABLE */; +@@ -2590,7 +2590,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_header_field_start; + } + default: { +- goto s_n_llhttp__internal__n_error_33; ++ goto s_n_llhttp__internal__n_error_34; + } + } + /* UNREACHABLE */; +@@ -2611,7 +2611,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_req_http_end_1; + } + default: { +- goto s_n_llhttp__internal__n_error_33; ++ goto s_n_llhttp__internal__n_error_34; + } + } + /* UNREACHABLE */; +@@ -2674,7 +2674,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_http_minor; + } + default: { +- goto s_n_llhttp__internal__n_error_34; ++ goto s_n_llhttp__internal__n_error_35; + } + } + /* UNREACHABLE */; +@@ -2691,7 +2691,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_req_http_minor; + } + default: { +- goto s_n_llhttp__internal__n_error_35; ++ goto s_n_llhttp__internal__n_error_36; + } + } + /* UNREACHABLE */; +@@ -2754,7 +2754,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_http_major; + } + default: { +- goto s_n_llhttp__internal__n_error_36; ++ goto s_n_llhttp__internal__n_error_37; + } + } + /* UNREACHABLE */; +@@ -2778,7 +2778,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_req_http_start_1; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_38; ++ goto s_n_llhttp__internal__n_error_39; + } + } + /* UNREACHABLE */; +@@ -2802,7 +2802,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_req_http_start_2; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_38; ++ goto s_n_llhttp__internal__n_error_39; + } + } + /* UNREACHABLE */; +@@ -2827,7 +2827,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_req_http_start_2; + } + default: { +- goto s_n_llhttp__internal__n_error_38; ++ goto s_n_llhttp__internal__n_error_39; + } + } + /* UNREACHABLE */; +@@ -2918,7 +2918,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_fragment; + } + default: { +- goto s_n_llhttp__internal__n_error_39; ++ goto s_n_llhttp__internal__n_error_40; + } + } + /* UNREACHABLE */; +@@ -2979,7 +2979,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_span_end_stub_query_3; + } + default: { +- goto s_n_llhttp__internal__n_error_40; ++ goto s_n_llhttp__internal__n_error_41; + } + } + /* UNREACHABLE */; +@@ -3017,7 +3017,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_query; + } + default: { +- goto s_n_llhttp__internal__n_error_41; ++ goto s_n_llhttp__internal__n_error_42; + } + } + /* UNREACHABLE */; +@@ -3142,10 +3142,10 @@ static llparse_state_t llhttp__internal_ + } + case 8: { + p++; +- goto s_n_llhttp__internal__n_error_42; ++ goto s_n_llhttp__internal__n_error_43; + } + default: { +- goto s_n_llhttp__internal__n_error_43; ++ goto s_n_llhttp__internal__n_error_44; + } + } + /* UNREACHABLE */; +@@ -3204,7 +3204,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_server_with_at; + } + default: { +- goto s_n_llhttp__internal__n_error_44; ++ goto s_n_llhttp__internal__n_error_45; + } + } + /* UNREACHABLE */; +@@ -3221,7 +3221,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_server; + } + default: { +- goto s_n_llhttp__internal__n_error_46; ++ goto s_n_llhttp__internal__n_error_47; + } + } + /* UNREACHABLE */; +@@ -3239,7 +3239,7 @@ static llparse_state_t llhttp__internal_ + } + case 10: { + p++; +- goto s_n_llhttp__internal__n_error_45; ++ goto s_n_llhttp__internal__n_error_46; + } + case 12: { + p++; +@@ -3247,18 +3247,18 @@ static llparse_state_t llhttp__internal_ + } + case 13: { + p++; +- goto s_n_llhttp__internal__n_error_45; ++ goto s_n_llhttp__internal__n_error_46; + } + case ' ': { + p++; +- goto s_n_llhttp__internal__n_error_45; ++ goto s_n_llhttp__internal__n_error_46; + } + case '/': { + p++; + goto s_n_llhttp__internal__n_url_schema_delim_1; + } + default: { +- goto s_n_llhttp__internal__n_error_46; ++ goto s_n_llhttp__internal__n_error_47; + } + } + /* UNREACHABLE */; +@@ -3304,7 +3304,7 @@ static llparse_state_t llhttp__internal_ + } + case 2: { + p++; +- goto s_n_llhttp__internal__n_error_45; ++ goto s_n_llhttp__internal__n_error_46; + } + case 3: { + goto s_n_llhttp__internal__n_span_end_stub_schema; +@@ -3314,7 +3314,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_schema; + } + default: { +- goto s_n_llhttp__internal__n_error_47; ++ goto s_n_llhttp__internal__n_error_48; + } + } + /* UNREACHABLE */; +@@ -3350,7 +3350,7 @@ static llparse_state_t llhttp__internal_ + } + case 2: { + p++; +- goto s_n_llhttp__internal__n_error_45; ++ goto s_n_llhttp__internal__n_error_46; + } + case 3: { + goto s_n_llhttp__internal__n_span_start_stub_path_2; +@@ -3359,7 +3359,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_schema; + } + default: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_49; + } + } + /* UNREACHABLE */; +@@ -3457,7 +3457,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_req_spaces_before_url; + } + default: { +- goto s_n_llhttp__internal__n_error_49; ++ goto s_n_llhttp__internal__n_error_50; + } + } + /* UNREACHABLE */; +@@ -3482,7 +3482,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_1; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -3507,7 +3507,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_2; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -3532,7 +3532,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_4; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -3557,7 +3557,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_6; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -3575,7 +3575,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_method_1; + } + default: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -3596,7 +3596,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_7; + } + default: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -3617,7 +3617,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_5; + } + default: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -3642,7 +3642,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_8; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -3667,7 +3667,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_9; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -3692,7 +3692,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_10; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -3717,7 +3717,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_12; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -3742,7 +3742,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_13; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -3763,7 +3763,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_13; + } + default: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -3788,7 +3788,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_15; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -3813,7 +3813,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_16; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -3838,7 +3838,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_18; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -3863,7 +3863,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_20; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -3881,7 +3881,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_method_1; + } + default: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -3902,7 +3902,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_21; + } + default: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -3923,7 +3923,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_19; + } + default: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -3948,7 +3948,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_22; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -3977,7 +3977,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_22; + } + default: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4002,7 +4002,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_23; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4027,7 +4027,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_24; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4052,7 +4052,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_26; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4077,7 +4077,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_27; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4102,7 +4102,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_31; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4127,7 +4127,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_32; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4148,7 +4148,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_32; + } + default: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4165,7 +4165,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_30; + } + default: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4187,7 +4187,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_29; + } + default: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4212,7 +4212,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_34; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4234,7 +4234,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_method_1; + } + default: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4263,7 +4263,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_33; + } + default: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4288,7 +4288,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_37; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4313,7 +4313,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_38; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4334,7 +4334,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_38; + } + default: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4351,7 +4351,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_36; + } + default: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4376,7 +4376,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_40; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4401,7 +4401,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_41; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4426,7 +4426,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_42; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4451,7 +4451,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_42; + } + default: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4476,7 +4476,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_43; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4501,7 +4501,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_46; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4526,7 +4526,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_48; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4551,7 +4551,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_49; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4572,7 +4572,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_49; + } + default: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4597,7 +4597,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_50; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4622,7 +4622,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_50; + } + default: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4639,7 +4639,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_45; + } + default: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4712,7 +4712,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_44; + } + default: { +- goto s_n_llhttp__internal__n_error_58; ++ goto s_n_llhttp__internal__n_error_59; + } + } + /* UNREACHABLE */; +@@ -4729,7 +4729,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_header_field_start; + } + default: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_52; + } + } + /* UNREACHABLE */; +@@ -4804,7 +4804,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_res_status_start; + } + default: { +- goto s_n_llhttp__internal__n_error_52; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -4884,7 +4884,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_update_status_code; + } + default: { +- goto s_n_llhttp__internal__n_error_53; ++ goto s_n_llhttp__internal__n_error_54; + } + } + /* UNREACHABLE */; +@@ -4947,7 +4947,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_http_minor_1; + } + default: { +- goto s_n_llhttp__internal__n_error_54; ++ goto s_n_llhttp__internal__n_error_55; + } + } + /* UNREACHABLE */; +@@ -4964,7 +4964,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_res_http_minor; + } + default: { +- goto s_n_llhttp__internal__n_error_55; ++ goto s_n_llhttp__internal__n_error_56; + } + } + /* UNREACHABLE */; +@@ -5027,7 +5027,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_http_major_1; + } + default: { +- goto s_n_llhttp__internal__n_error_56; ++ goto s_n_llhttp__internal__n_error_57; + } + } + /* UNREACHABLE */; +@@ -5051,7 +5051,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_res; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_59; ++ goto s_n_llhttp__internal__n_error_60; + } + } + /* UNREACHABLE */; +@@ -5076,7 +5076,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_req_or_res_method_2; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_57; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -5100,7 +5100,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_req_or_res_method_3; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_57; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -5121,7 +5121,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_req_or_res_method_3; + } + default: { +- goto s_n_llhttp__internal__n_error_57; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -5138,7 +5138,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_req_or_res_method_1; + } + default: { +- goto s_n_llhttp__internal__n_error_57; ++ goto s_n_llhttp__internal__n_error_58; + } + } + /* UNREACHABLE */; +@@ -5207,7 +5207,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_45: { ++ s_n_llhttp__internal__n_error_46: { + state->error = 0x7; + state->reason = "Invalid characters in url"; + state->error_pos = (const char*) p; +@@ -5696,6 +5696,15 @@ static llparse_state_t llhttp__internal_ + abort(); + } + s_n_llhttp__internal__n_error_22: { ++ state->error = 0xa; ++ state->reason = "Invalid header value char"; ++ state->error_pos = (const char*) p; ++ state->_current = (void*) (intptr_t) s_error; ++ return s_error; ++ /* UNREACHABLE */; ++ abort(); ++ } ++ s_n_llhttp__internal__n_error_23: { + state->error = 0xb; + state->reason = "Empty Content-Length"; + state->error_pos = (const char*) p; +@@ -5780,7 +5789,7 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_load_header_state: { + switch (llhttp__internal__c_load_header_state(state, p, endp)) { + case 2: +- goto s_n_llhttp__internal__n_error_22; ++ goto s_n_llhttp__internal__n_error_23; + default: + goto s_n_llhttp__internal__n_invoke_load_header_state_1; + } +@@ -5806,7 +5815,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_23: { ++ s_n_llhttp__internal__n_error_24: { + state->error = 0x2; + state->reason = "Expected LF after CR"; + state->error_pos = (const char*) p; +@@ -5889,7 +5898,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_24: { ++ s_n_llhttp__internal__n_error_25: { + state->error = 0x3; + state->reason = "Missing expected LF after header value"; + state->error_pos = (const char*) p; +@@ -5961,10 +5970,10 @@ static llparse_state_t llhttp__internal_ + if (err != 0) { + state->error = err; + state->error_pos = (const char*) p; +- state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_25; ++ state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_26; + return s_error; + } +- goto s_n_llhttp__internal__n_error_25; ++ goto s_n_llhttp__internal__n_error_26; + /* UNREACHABLE */; + abort(); + } +@@ -6076,10 +6085,10 @@ static llparse_state_t llhttp__internal_ + if (err != 0) { + state->error = err; + state->error_pos = (const char*) p; +- state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_27; ++ state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_28; + return s_error; + } +- goto s_n_llhttp__internal__n_error_27; ++ goto s_n_llhttp__internal__n_error_28; + /* UNREACHABLE */; + abort(); + } +@@ -6111,14 +6120,14 @@ static llparse_state_t llhttp__internal_ + if (err != 0) { + state->error = err; + state->error_pos = (const char*) p; +- state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_28; ++ state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_29; + return s_error; + } +- goto s_n_llhttp__internal__n_error_28; ++ goto s_n_llhttp__internal__n_error_29; + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_26: { ++ s_n_llhttp__internal__n_error_27: { + state->error = 0x4; + state->reason = "Duplicate Content-Length"; + state->error_pos = (const char*) p; +@@ -6132,7 +6141,7 @@ static llparse_state_t llhttp__internal_ + case 0: + goto s_n_llhttp__internal__n_header_value_content_length; + default: +- goto s_n_llhttp__internal__n_error_26; ++ goto s_n_llhttp__internal__n_error_27; + } + /* UNREACHABLE */; + abort(); +@@ -6147,11 +6156,11 @@ static llparse_state_t llhttp__internal_ + if (err != 0) { + state->error = err; + state->error_pos = (const char*) (p + 1); +- state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_30; ++ state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_31; + return s_error; + } + p++; +- goto s_n_llhttp__internal__n_error_30; ++ goto s_n_llhttp__internal__n_error_31; + /* UNREACHABLE */; + abort(); + } +@@ -6173,11 +6182,11 @@ static llparse_state_t llhttp__internal_ + if (err != 0) { + state->error = err; + state->error_pos = (const char*) (p + 1); +- state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_29; ++ state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_30; + return s_error; + } + p++; +- goto s_n_llhttp__internal__n_error_29; ++ goto s_n_llhttp__internal__n_error_30; + /* UNREACHABLE */; + abort(); + } +@@ -6323,7 +6332,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_31: { ++ s_n_llhttp__internal__n_error_32: { + state->error = 0xa; + state->reason = "Invalid header token"; + state->error_pos = (const char*) p; +@@ -6389,7 +6398,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_32: { ++ s_n_llhttp__internal__n_error_33: { + state->error = 0x7; + state->reason = "Expected CRLF"; + state->error_pos = (const char*) p; +@@ -6415,7 +6424,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_33: { ++ s_n_llhttp__internal__n_error_34: { + state->error = 0x9; + state->reason = "Expected CRLF after version"; + state->error_pos = (const char*) p; +@@ -6432,7 +6441,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_34: { ++ s_n_llhttp__internal__n_error_35: { + state->error = 0x9; + state->reason = "Invalid minor version"; + state->error_pos = (const char*) p; +@@ -6441,7 +6450,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_35: { ++ s_n_llhttp__internal__n_error_36: { + state->error = 0x9; + state->reason = "Expected dot"; + state->error_pos = (const char*) p; +@@ -6458,7 +6467,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_36: { ++ s_n_llhttp__internal__n_error_37: { + state->error = 0x9; + state->reason = "Invalid major version"; + state->error_pos = (const char*) p; +@@ -6467,7 +6476,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_38: { ++ s_n_llhttp__internal__n_error_39: { + state->error = 0x8; + state->reason = "Expected HTTP/"; + state->error_pos = (const char*) p; +@@ -6476,7 +6485,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_37: { ++ s_n_llhttp__internal__n_error_38: { + state->error = 0x8; + state->reason = "Expected SOURCE method for ICE/x.x request"; + state->error_pos = (const char*) p; +@@ -6488,7 +6497,7 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_is_equal_method_1: { + switch (llhttp__internal__c_is_equal_method_1(state, p, endp)) { + case 0: +- goto s_n_llhttp__internal__n_error_37; ++ goto s_n_llhttp__internal__n_error_38; + default: + goto s_n_llhttp__internal__n_req_http_major; + } +@@ -6563,7 +6572,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_39: { ++ s_n_llhttp__internal__n_error_40: { + state->error = 0x7; + state->reason = "Invalid char in url fragment start"; + state->error_pos = (const char*) p; +@@ -6623,7 +6632,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_40: { ++ s_n_llhttp__internal__n_error_41: { + state->error = 0x7; + state->reason = "Invalid char in url query"; + state->error_pos = (const char*) p; +@@ -6632,7 +6641,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_41: { ++ s_n_llhttp__internal__n_error_42: { + state->error = 0x7; + state->reason = "Invalid char in url path"; + state->error_pos = (const char*) p; +@@ -6743,7 +6752,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_42: { ++ s_n_llhttp__internal__n_error_43: { + state->error = 0x7; + state->reason = "Double @ in url"; + state->error_pos = (const char*) p; +@@ -6752,7 +6761,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_43: { ++ s_n_llhttp__internal__n_error_44: { + state->error = 0x7; + state->reason = "Unexpected char in url server"; + state->error_pos = (const char*) p; +@@ -6761,7 +6770,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_44: { ++ s_n_llhttp__internal__n_error_45: { + state->error = 0x7; + state->reason = "Unexpected char in url server"; + state->error_pos = (const char*) p; +@@ -6770,7 +6779,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_46: { ++ s_n_llhttp__internal__n_error_47: { + state->error = 0x7; + state->reason = "Unexpected char in url schema"; + state->error_pos = (const char*) p; +@@ -6779,7 +6788,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_47: { ++ s_n_llhttp__internal__n_error_48: { + state->error = 0x7; + state->reason = "Unexpected char in url schema"; + state->error_pos = (const char*) p; +@@ -6788,7 +6797,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_48: { ++ s_n_llhttp__internal__n_error_49: { + state->error = 0x7; + state->reason = "Unexpected start char in url"; + state->error_pos = (const char*) p; +@@ -6807,7 +6816,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_49: { ++ s_n_llhttp__internal__n_error_50: { + state->error = 0x6; + state->reason = "Expected space after method"; + state->error_pos = (const char*) p; +@@ -6824,7 +6833,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_58: { ++ s_n_llhttp__internal__n_error_59: { + state->error = 0x6; + state->reason = "Invalid method encountered"; + state->error_pos = (const char*) p; +@@ -6833,7 +6842,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_50: { ++ s_n_llhttp__internal__n_error_51: { + state->error = 0xd; + state->reason = "Response overflow"; + state->error_pos = (const char*) p; +@@ -6845,14 +6854,14 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_mul_add_status_code: { + switch (llhttp__internal__c_mul_add_status_code(state, p, endp, match)) { + case 1: +- goto s_n_llhttp__internal__n_error_50; ++ goto s_n_llhttp__internal__n_error_51; + default: + goto s_n_llhttp__internal__n_res_status_code; + } + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_51: { ++ s_n_llhttp__internal__n_error_52: { + state->error = 0x2; + state->reason = "Expected LF after CR"; + state->error_pos = (const char*) p; +@@ -6897,7 +6906,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_52: { ++ s_n_llhttp__internal__n_error_53: { + state->error = 0xd; + state->reason = "Invalid response status"; + state->error_pos = (const char*) p; +@@ -6914,7 +6923,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_53: { ++ s_n_llhttp__internal__n_error_54: { + state->error = 0x9; + state->reason = "Expected space after version"; + state->error_pos = (const char*) p; +@@ -6931,7 +6940,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_54: { ++ s_n_llhttp__internal__n_error_55: { + state->error = 0x9; + state->reason = "Invalid minor version"; + state->error_pos = (const char*) p; +@@ -6940,7 +6949,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_55: { ++ s_n_llhttp__internal__n_error_56: { + state->error = 0x9; + state->reason = "Expected dot"; + state->error_pos = (const char*) p; +@@ -6957,7 +6966,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_56: { ++ s_n_llhttp__internal__n_error_57: { + state->error = 0x9; + state->reason = "Invalid major version"; + state->error_pos = (const char*) p; +@@ -6966,7 +6975,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_59: { ++ s_n_llhttp__internal__n_error_60: { + state->error = 0x8; + state->reason = "Expected HTTP/"; + state->error_pos = (const char*) p; +@@ -6991,7 +7000,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_57: { ++ s_n_llhttp__internal__n_error_58: { + state->error = 0x8; + state->reason = "Invalid word encountered"; + state->error_pos = (const char*) p; +@@ -7423,7 +7432,7 @@ enum llparse_state_e { + s_n_llhttp__internal__n_header_value_lws, + s_n_llhttp__internal__n_header_value_almost_done, + s_n_llhttp__internal__n_header_value_lenient, +- s_n_llhttp__internal__n_error_19, ++ s_n_llhttp__internal__n_error_21, + s_n_llhttp__internal__n_header_value_otherwise, + s_n_llhttp__internal__n_header_value_connection_token, + s_n_llhttp__internal__n_header_value_connection_ws, +@@ -7431,12 +7440,12 @@ enum llparse_state_e { + s_n_llhttp__internal__n_header_value_connection_2, + s_n_llhttp__internal__n_header_value_connection_3, + s_n_llhttp__internal__n_header_value_connection, +- s_n_llhttp__internal__n_error_21, +- s_n_llhttp__internal__n_error_22, ++ s_n_llhttp__internal__n_error_23, ++ s_n_llhttp__internal__n_error_24, + s_n_llhttp__internal__n_header_value_content_length_ws, + s_n_llhttp__internal__n_header_value_content_length, +- s_n_llhttp__internal__n_error_24, +- s_n_llhttp__internal__n_error_23, ++ s_n_llhttp__internal__n_error_26, ++ s_n_llhttp__internal__n_error_25, + s_n_llhttp__internal__n_header_value_te_token_ows, + s_n_llhttp__internal__n_header_value, + s_n_llhttp__internal__n_header_value_te_token, +@@ -8591,11 +8600,11 @@ static llparse_state_t llhttp__internal_ + switch (*p) { + case 9: { + p++; +- goto s_n_llhttp__internal__n_header_value_discard_ws; ++ goto s_n_llhttp__internal__n_error_17; + } + case ' ': { + p++; +- goto s_n_llhttp__internal__n_header_value_discard_ws; ++ goto s_n_llhttp__internal__n_error_17; + } + default: { + goto s_n_llhttp__internal__n_invoke_load_header_state; +@@ -8609,8 +8618,15 @@ static llparse_state_t llhttp__internal_ + if (p == endp) { + return s_n_llhttp__internal__n_header_value_discard_ws_almost_done; + } +- p++; +- goto s_n_llhttp__internal__n_header_value_discard_lws; ++ switch (*p) { ++ case 10: { ++ p++; ++ goto s_n_llhttp__internal__n_header_value_discard_lws; ++ } ++ default: { ++ goto s_n_llhttp__internal__n_error_19; ++ } ++ } + /* UNREACHABLE */; + abort(); + } +@@ -8644,7 +8660,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_header_value_lws; + } + default: { +- goto s_n_llhttp__internal__n_error_18; ++ goto s_n_llhttp__internal__n_error_20; + } + } + /* UNREACHABLE */; +@@ -8670,8 +8686,8 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- case s_n_llhttp__internal__n_error_19: +- s_n_llhttp__internal__n_error_19: { ++ case s_n_llhttp__internal__n_error_21: ++ s_n_llhttp__internal__n_error_21: { + state->error = 0xa; + state->reason = "Invalid header value char"; + state->error_pos = (const char*) p; +@@ -8867,8 +8883,8 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- case s_n_llhttp__internal__n_error_21: +- s_n_llhttp__internal__n_error_21: { ++ case s_n_llhttp__internal__n_error_23: ++ s_n_llhttp__internal__n_error_23: { + state->error = 0xb; + state->reason = "Content-Length overflow"; + state->error_pos = (const char*) p; +@@ -8877,8 +8893,8 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- case s_n_llhttp__internal__n_error_22: +- s_n_llhttp__internal__n_error_22: { ++ case s_n_llhttp__internal__n_error_24: ++ s_n_llhttp__internal__n_error_24: { + state->error = 0xb; + state->reason = "Invalid character in Content-Length"; + state->error_pos = (const char*) p; +@@ -8973,8 +8989,8 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- case s_n_llhttp__internal__n_error_24: +- s_n_llhttp__internal__n_error_24: { ++ case s_n_llhttp__internal__n_error_26: ++ s_n_llhttp__internal__n_error_26: { + state->error = 0xf; + state->reason = "Invalid `Transfer-Encoding` header value"; + state->error_pos = (const char*) p; +@@ -8983,8 +8999,8 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- case s_n_llhttp__internal__n_error_23: +- s_n_llhttp__internal__n_error_23: { ++ case s_n_llhttp__internal__n_error_25: ++ s_n_llhttp__internal__n_error_25: { + state->error = 0xf; + state->reason = "Invalid `Transfer-Encoding` header value"; + state->error_pos = (const char*) p; +@@ -9212,7 +9228,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_span_end_llhttp__on_header_field_2; + } + default: { +- goto s_n_llhttp__internal__n_error_25; ++ goto s_n_llhttp__internal__n_error_27; + } + } + /* UNREACHABLE */; +@@ -9566,7 +9582,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_url_skip_lf_to_http09; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_26; ++ goto s_n_llhttp__internal__n_error_28; + } + } + /* UNREACHABLE */; +@@ -9583,7 +9599,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_header_field_start; + } + default: { +- goto s_n_llhttp__internal__n_error_27; ++ goto s_n_llhttp__internal__n_error_29; + } + } + /* UNREACHABLE */; +@@ -9604,7 +9620,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_req_http_end_1; + } + default: { +- goto s_n_llhttp__internal__n_error_27; ++ goto s_n_llhttp__internal__n_error_29; + } + } + /* UNREACHABLE */; +@@ -9667,7 +9683,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_http_minor; + } + default: { +- goto s_n_llhttp__internal__n_error_28; ++ goto s_n_llhttp__internal__n_error_30; + } + } + /* UNREACHABLE */; +@@ -9684,7 +9700,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_req_http_minor; + } + default: { +- goto s_n_llhttp__internal__n_error_29; ++ goto s_n_llhttp__internal__n_error_31; + } + } + /* UNREACHABLE */; +@@ -9747,7 +9763,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_http_major; + } + default: { +- goto s_n_llhttp__internal__n_error_30; ++ goto s_n_llhttp__internal__n_error_32; + } + } + /* UNREACHABLE */; +@@ -9771,7 +9787,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_req_http_start_1; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_32; ++ goto s_n_llhttp__internal__n_error_34; + } + } + /* UNREACHABLE */; +@@ -9795,7 +9811,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_req_http_start_2; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_32; ++ goto s_n_llhttp__internal__n_error_34; + } + } + /* UNREACHABLE */; +@@ -9820,7 +9836,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_req_http_start_2; + } + default: { +- goto s_n_llhttp__internal__n_error_32; ++ goto s_n_llhttp__internal__n_error_34; + } + } + /* UNREACHABLE */; +@@ -9874,7 +9890,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_span_end_llhttp__on_url_8; + } + default: { +- goto s_n_llhttp__internal__n_error_33; ++ goto s_n_llhttp__internal__n_error_35; + } + } + /* UNREACHABLE */; +@@ -9931,7 +9947,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_span_end_stub_query_3; + } + default: { +- goto s_n_llhttp__internal__n_error_34; ++ goto s_n_llhttp__internal__n_error_36; + } + } + /* UNREACHABLE */; +@@ -9961,7 +9977,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_query; + } + default: { +- goto s_n_llhttp__internal__n_error_35; ++ goto s_n_llhttp__internal__n_error_37; + } + } + /* UNREACHABLE */; +@@ -10102,10 +10118,10 @@ static llparse_state_t llhttp__internal_ + } + case 7: { + p++; +- goto s_n_llhttp__internal__n_error_36; ++ goto s_n_llhttp__internal__n_error_38; + } + default: { +- goto s_n_llhttp__internal__n_error_37; ++ goto s_n_llhttp__internal__n_error_39; + } + } + /* UNREACHABLE */; +@@ -10160,7 +10176,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_server_with_at; + } + default: { +- goto s_n_llhttp__internal__n_error_38; ++ goto s_n_llhttp__internal__n_error_40; + } + } + /* UNREACHABLE */; +@@ -10177,7 +10193,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_server; + } + default: { +- goto s_n_llhttp__internal__n_error_40; ++ goto s_n_llhttp__internal__n_error_42; + } + } + /* UNREACHABLE */; +@@ -10191,22 +10207,22 @@ static llparse_state_t llhttp__internal_ + switch (*p) { + case 10: { + p++; +- goto s_n_llhttp__internal__n_error_39; ++ goto s_n_llhttp__internal__n_error_41; + } + case 13: { + p++; +- goto s_n_llhttp__internal__n_error_39; ++ goto s_n_llhttp__internal__n_error_41; + } + case ' ': { + p++; +- goto s_n_llhttp__internal__n_error_39; ++ goto s_n_llhttp__internal__n_error_41; + } + case '/': { + p++; + goto s_n_llhttp__internal__n_url_schema_delim_1; + } + default: { +- goto s_n_llhttp__internal__n_error_40; ++ goto s_n_llhttp__internal__n_error_42; + } + } + /* UNREACHABLE */; +@@ -10248,7 +10264,7 @@ static llparse_state_t llhttp__internal_ + switch (lookup_table[(uint8_t) *p]) { + case 1: { + p++; +- goto s_n_llhttp__internal__n_error_39; ++ goto s_n_llhttp__internal__n_error_41; + } + case 2: { + goto s_n_llhttp__internal__n_span_end_stub_schema; +@@ -10258,7 +10274,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_schema; + } + default: { +- goto s_n_llhttp__internal__n_error_41; ++ goto s_n_llhttp__internal__n_error_43; + } + } + /* UNREACHABLE */; +@@ -10290,7 +10306,7 @@ static llparse_state_t llhttp__internal_ + switch (lookup_table[(uint8_t) *p]) { + case 1: { + p++; +- goto s_n_llhttp__internal__n_error_39; ++ goto s_n_llhttp__internal__n_error_41; + } + case 2: { + goto s_n_llhttp__internal__n_span_start_stub_path_2; +@@ -10299,7 +10315,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_url_schema; + } + default: { +- goto s_n_llhttp__internal__n_error_42; ++ goto s_n_llhttp__internal__n_error_44; + } + } + /* UNREACHABLE */; +@@ -10355,7 +10371,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_req_spaces_before_url; + } + default: { +- goto s_n_llhttp__internal__n_error_43; ++ goto s_n_llhttp__internal__n_error_45; + } + } + /* UNREACHABLE */; +@@ -10380,7 +10396,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_1; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -10405,7 +10421,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_2; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -10430,7 +10446,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_4; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -10455,7 +10471,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_6; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -10473,7 +10489,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_method_1; + } + default: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -10494,7 +10510,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_7; + } + default: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -10515,7 +10531,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_5; + } + default: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -10540,7 +10556,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_8; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -10565,7 +10581,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_9; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -10590,7 +10606,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_10; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -10615,7 +10631,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_12; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -10640,7 +10656,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_13; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -10661,7 +10677,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_13; + } + default: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -10686,7 +10702,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_15; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -10711,7 +10727,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_16; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -10736,7 +10752,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_18; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -10761,7 +10777,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_20; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -10779,7 +10795,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_method_1; + } + default: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -10800,7 +10816,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_21; + } + default: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -10821,7 +10837,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_19; + } + default: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -10846,7 +10862,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_22; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -10875,7 +10891,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_22; + } + default: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -10900,7 +10916,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_23; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -10925,7 +10941,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_24; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -10950,7 +10966,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_26; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -10975,7 +10991,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_27; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11000,7 +11016,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_31; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11025,7 +11041,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_32; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11046,7 +11062,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_32; + } + default: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11063,7 +11079,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_30; + } + default: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11085,7 +11101,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_29; + } + default: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11110,7 +11126,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_34; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11132,7 +11148,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_method_1; + } + default: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11161,7 +11177,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_33; + } + default: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11186,7 +11202,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_37; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11211,7 +11227,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_38; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11232,7 +11248,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_38; + } + default: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11249,7 +11265,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_36; + } + default: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11274,7 +11290,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_40; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11299,7 +11315,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_41; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11324,7 +11340,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_42; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11349,7 +11365,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_42; + } + default: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11374,7 +11390,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_43; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11399,7 +11415,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_46; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11424,7 +11440,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_48; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11449,7 +11465,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_49; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11470,7 +11486,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_49; + } + default: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11495,7 +11511,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_req_50; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11520,7 +11536,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_50; + } + default: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11537,7 +11553,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_45; + } + default: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11610,7 +11626,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_start_req_44; + } + default: { +- goto s_n_llhttp__internal__n_error_51; ++ goto s_n_llhttp__internal__n_error_53; + } + } + /* UNREACHABLE */; +@@ -11695,7 +11711,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_res_status_start; + } + default: { +- goto s_n_llhttp__internal__n_error_45; ++ goto s_n_llhttp__internal__n_error_47; + } + } + /* UNREACHABLE */; +@@ -11775,7 +11791,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_update_status_code; + } + default: { +- goto s_n_llhttp__internal__n_error_46; ++ goto s_n_llhttp__internal__n_error_48; + } + } + /* UNREACHABLE */; +@@ -11838,7 +11854,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_http_minor_1; + } + default: { +- goto s_n_llhttp__internal__n_error_47; ++ goto s_n_llhttp__internal__n_error_49; + } + } + /* UNREACHABLE */; +@@ -11855,7 +11871,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_res_http_minor; + } + default: { +- goto s_n_llhttp__internal__n_error_48; ++ goto s_n_llhttp__internal__n_error_50; + } + } + /* UNREACHABLE */; +@@ -11918,7 +11934,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_invoke_store_http_major_1; + } + default: { +- goto s_n_llhttp__internal__n_error_49; ++ goto s_n_llhttp__internal__n_error_51; + } + } + /* UNREACHABLE */; +@@ -11942,7 +11958,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_start_res; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_52; ++ goto s_n_llhttp__internal__n_error_54; + } + } + /* UNREACHABLE */; +@@ -11967,7 +11983,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_req_or_res_method_2; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_50; ++ goto s_n_llhttp__internal__n_error_52; + } + } + /* UNREACHABLE */; +@@ -11991,7 +12007,7 @@ static llparse_state_t llhttp__internal_ + return s_n_llhttp__internal__n_req_or_res_method_3; + } + case kMatchMismatch: { +- goto s_n_llhttp__internal__n_error_50; ++ goto s_n_llhttp__internal__n_error_52; + } + } + /* UNREACHABLE */; +@@ -12012,7 +12028,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_req_or_res_method_3; + } + default: { +- goto s_n_llhttp__internal__n_error_50; ++ goto s_n_llhttp__internal__n_error_52; + } + } + /* UNREACHABLE */; +@@ -12029,7 +12045,7 @@ static llparse_state_t llhttp__internal_ + goto s_n_llhttp__internal__n_req_or_res_method_1; + } + default: { +- goto s_n_llhttp__internal__n_error_50; ++ goto s_n_llhttp__internal__n_error_52; + } + } + /* UNREACHABLE */; +@@ -12089,7 +12105,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */ + abort(); + } +- s_n_llhttp__internal__n_error_39: { ++ s_n_llhttp__internal__n_error_41: { + state->error = 0x7; + state->reason = "Invalid characters in url"; + state->error_pos = (const char*) p; +@@ -12534,6 +12550,15 @@ static llparse_state_t llhttp__internal_ + abort(); + } + s_n_llhttp__internal__n_error_17: { ++ state->error = 0xa; ++ state->reason = "Invalid header value char"; ++ state->error_pos = (const char*) p; ++ state->_current = (void*) (intptr_t) s_error; ++ return s_error; ++ /* UNREACHABLE */; ++ abort(); ++ } ++ s_n_llhttp__internal__n_error_18: { + state->error = 0xb; + state->reason = "Empty Content-Length"; + state->error_pos = (const char*) p; +@@ -12618,7 +12643,7 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_load_header_state: { + switch (llhttp__internal__c_load_header_state(state, p, endp)) { + case 2: +- goto s_n_llhttp__internal__n_error_17; ++ goto s_n_llhttp__internal__n_error_18; + default: + goto s_n_llhttp__internal__n_invoke_load_header_state_1; + } +@@ -12644,6 +12669,15 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } ++ s_n_llhttp__internal__n_error_19: { ++ state->error = 0x2; ++ state->reason = "Expected LF after CR"; ++ state->error_pos = (const char*) p; ++ state->_current = (void*) (intptr_t) s_error; ++ return s_error; ++ /* UNREACHABLE */; ++ abort(); ++ } + s_n_llhttp__internal__n_invoke_update_header_state_1: { + switch (llhttp__internal__c_update_header_state_1(state, p, endp)) { + default: +@@ -12718,7 +12752,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_18: { ++ s_n_llhttp__internal__n_error_20: { + state->error = 0x3; + state->reason = "Missing expected LF after header value"; + state->error_pos = (const char*) p; +@@ -12790,10 +12824,10 @@ static llparse_state_t llhttp__internal_ + if (err != 0) { + state->error = err; + state->error_pos = (const char*) p; +- state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_19; ++ state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_21; + return s_error; + } +- goto s_n_llhttp__internal__n_error_19; ++ goto s_n_llhttp__internal__n_error_21; + /* UNREACHABLE */; + abort(); + } +@@ -12905,10 +12939,10 @@ static llparse_state_t llhttp__internal_ + if (err != 0) { + state->error = err; + state->error_pos = (const char*) p; +- state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_21; ++ state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_23; + return s_error; + } +- goto s_n_llhttp__internal__n_error_21; ++ goto s_n_llhttp__internal__n_error_23; + /* UNREACHABLE */; + abort(); + } +@@ -12940,14 +12974,14 @@ static llparse_state_t llhttp__internal_ + if (err != 0) { + state->error = err; + state->error_pos = (const char*) p; +- state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_22; ++ state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_24; + return s_error; + } +- goto s_n_llhttp__internal__n_error_22; ++ goto s_n_llhttp__internal__n_error_24; + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_20: { ++ s_n_llhttp__internal__n_error_22: { + state->error = 0x4; + state->reason = "Duplicate Content-Length"; + state->error_pos = (const char*) p; +@@ -12961,7 +12995,7 @@ static llparse_state_t llhttp__internal_ + case 0: + goto s_n_llhttp__internal__n_header_value_content_length; + default: +- goto s_n_llhttp__internal__n_error_20; ++ goto s_n_llhttp__internal__n_error_22; + } + /* UNREACHABLE */; + abort(); +@@ -12976,11 +13010,11 @@ static llparse_state_t llhttp__internal_ + if (err != 0) { + state->error = err; + state->error_pos = (const char*) (p + 1); +- state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_24; ++ state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_26; + return s_error; + } + p++; +- goto s_n_llhttp__internal__n_error_24; ++ goto s_n_llhttp__internal__n_error_26; + /* UNREACHABLE */; + abort(); + } +@@ -13002,11 +13036,11 @@ static llparse_state_t llhttp__internal_ + if (err != 0) { + state->error = err; + state->error_pos = (const char*) (p + 1); +- state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_23; ++ state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_25; + return s_error; + } + p++; +- goto s_n_llhttp__internal__n_error_23; ++ goto s_n_llhttp__internal__n_error_25; + /* UNREACHABLE */; + abort(); + } +@@ -13152,7 +13186,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_25: { ++ s_n_llhttp__internal__n_error_27: { + state->error = 0xa; + state->reason = "Invalid header token"; + state->error_pos = (const char*) p; +@@ -13218,7 +13252,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_26: { ++ s_n_llhttp__internal__n_error_28: { + state->error = 0x7; + state->reason = "Expected CRLF"; + state->error_pos = (const char*) p; +@@ -13244,7 +13278,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_27: { ++ s_n_llhttp__internal__n_error_29: { + state->error = 0x9; + state->reason = "Expected CRLF after version"; + state->error_pos = (const char*) p; +@@ -13261,7 +13295,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_28: { ++ s_n_llhttp__internal__n_error_30: { + state->error = 0x9; + state->reason = "Invalid minor version"; + state->error_pos = (const char*) p; +@@ -13270,7 +13304,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_29: { ++ s_n_llhttp__internal__n_error_31: { + state->error = 0x9; + state->reason = "Expected dot"; + state->error_pos = (const char*) p; +@@ -13287,7 +13321,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_30: { ++ s_n_llhttp__internal__n_error_32: { + state->error = 0x9; + state->reason = "Invalid major version"; + state->error_pos = (const char*) p; +@@ -13296,7 +13330,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_32: { ++ s_n_llhttp__internal__n_error_34: { + state->error = 0x8; + state->reason = "Expected HTTP/"; + state->error_pos = (const char*) p; +@@ -13305,7 +13339,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_31: { ++ s_n_llhttp__internal__n_error_33: { + state->error = 0x8; + state->reason = "Expected SOURCE method for ICE/x.x request"; + state->error_pos = (const char*) p; +@@ -13317,7 +13351,7 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_is_equal_method_1: { + switch (llhttp__internal__c_is_equal_method_1(state, p, endp)) { + case 0: +- goto s_n_llhttp__internal__n_error_31; ++ goto s_n_llhttp__internal__n_error_33; + default: + goto s_n_llhttp__internal__n_req_http_major; + } +@@ -13392,7 +13426,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_33: { ++ s_n_llhttp__internal__n_error_35: { + state->error = 0x7; + state->reason = "Invalid char in url fragment start"; + state->error_pos = (const char*) p; +@@ -13452,7 +13486,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_34: { ++ s_n_llhttp__internal__n_error_36: { + state->error = 0x7; + state->reason = "Invalid char in url query"; + state->error_pos = (const char*) p; +@@ -13461,7 +13495,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_35: { ++ s_n_llhttp__internal__n_error_37: { + state->error = 0x7; + state->reason = "Invalid char in url path"; + state->error_pos = (const char*) p; +@@ -13572,7 +13606,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_36: { ++ s_n_llhttp__internal__n_error_38: { + state->error = 0x7; + state->reason = "Double @ in url"; + state->error_pos = (const char*) p; +@@ -13581,7 +13615,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_37: { ++ s_n_llhttp__internal__n_error_39: { + state->error = 0x7; + state->reason = "Unexpected char in url server"; + state->error_pos = (const char*) p; +@@ -13590,7 +13624,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_38: { ++ s_n_llhttp__internal__n_error_40: { + state->error = 0x7; + state->reason = "Unexpected char in url server"; + state->error_pos = (const char*) p; +@@ -13599,7 +13633,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_40: { ++ s_n_llhttp__internal__n_error_42: { + state->error = 0x7; + state->reason = "Unexpected char in url schema"; + state->error_pos = (const char*) p; +@@ -13608,7 +13642,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_41: { ++ s_n_llhttp__internal__n_error_43: { + state->error = 0x7; + state->reason = "Unexpected char in url schema"; + state->error_pos = (const char*) p; +@@ -13617,7 +13651,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_42: { ++ s_n_llhttp__internal__n_error_44: { + state->error = 0x7; + state->reason = "Unexpected start char in url"; + state->error_pos = (const char*) p; +@@ -13636,7 +13670,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_43: { ++ s_n_llhttp__internal__n_error_45: { + state->error = 0x6; + state->reason = "Expected space after method"; + state->error_pos = (const char*) p; +@@ -13653,7 +13687,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_51: { ++ s_n_llhttp__internal__n_error_53: { + state->error = 0x6; + state->reason = "Invalid method encountered"; + state->error_pos = (const char*) p; +@@ -13662,7 +13696,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_44: { ++ s_n_llhttp__internal__n_error_46: { + state->error = 0xd; + state->reason = "Response overflow"; + state->error_pos = (const char*) p; +@@ -13674,7 +13708,7 @@ static llparse_state_t llhttp__internal_ + s_n_llhttp__internal__n_invoke_mul_add_status_code: { + switch (llhttp__internal__c_mul_add_status_code(state, p, endp, match)) { + case 1: +- goto s_n_llhttp__internal__n_error_44; ++ goto s_n_llhttp__internal__n_error_46; + default: + goto s_n_llhttp__internal__n_res_status_code; + } +@@ -13717,7 +13751,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_45: { ++ s_n_llhttp__internal__n_error_47: { + state->error = 0xd; + state->reason = "Invalid response status"; + state->error_pos = (const char*) p; +@@ -13734,7 +13768,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_46: { ++ s_n_llhttp__internal__n_error_48: { + state->error = 0x9; + state->reason = "Expected space after version"; + state->error_pos = (const char*) p; +@@ -13751,7 +13785,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_47: { ++ s_n_llhttp__internal__n_error_49: { + state->error = 0x9; + state->reason = "Invalid minor version"; + state->error_pos = (const char*) p; +@@ -13760,7 +13794,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_48: { ++ s_n_llhttp__internal__n_error_50: { + state->error = 0x9; + state->reason = "Expected dot"; + state->error_pos = (const char*) p; +@@ -13777,7 +13811,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_49: { ++ s_n_llhttp__internal__n_error_51: { + state->error = 0x9; + state->reason = "Invalid major version"; + state->error_pos = (const char*) p; +@@ -13786,7 +13820,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_52: { ++ s_n_llhttp__internal__n_error_54: { + state->error = 0x8; + state->reason = "Expected HTTP/"; + state->error_pos = (const char*) p; +@@ -13811,7 +13845,7 @@ static llparse_state_t llhttp__internal_ + /* UNREACHABLE */; + abort(); + } +- s_n_llhttp__internal__n_error_50: { ++ s_n_llhttp__internal__n_error_52: { + state->error = 0x8; + state->reason = "Invalid word encountered"; + state->error_pos = (const char*) p; diff --git a/CVE-2023-30590.patch b/CVE-2023-30590.patch new file mode 100644 index 0000000000000000000000000000000000000000..d63c65cb0b78790cfc6c742fb013b3c541c7a22b --- /dev/null +++ b/CVE-2023-30590.patch @@ -0,0 +1,165 @@ +commit 1a5c9284ebce5cd71cf7a3c29759a748c373ac85 +Author: Tobias Nießen +Date: Mon Jun 12 19:44:48 2023 +0200 + + doc,test: clarify behavior of DH generateKeys + + The DiffieHellman class is an old and thin wrapper around certain + OpenSSL functions, many of which are deprecated in OpenSSL 3.0. Because + the Node.js API mirrors the OpenSSL API, it adopts some of its + peculiarities, but the Node.js documentation does not properly reflect + these. Most importantly, despite the documentation saying otherwise, + diffieHellman.generateKeys() does not generate a new private key when + one has already been set or generated. Based on the documentation alone, + users may be led to misuse the API in a way that results in key reuse, + which can have drastic negative consequences for subsequent operations + that consume the shared secret. + + These design issues in this old API have been around for many years, and + we are not currently aware of any misuse in the ecosystem that falls + into the above scenario. Changing the behavior of the API would be a + significant breaking change and is thus not appropriate for a security + release (nor is it a goal.) The reported issue is treated as CWE-1068 + (after a vast amount of uncertainty whether to treat it as a + vulnerability at all), therefore, this change only updates the + documentation to match the actual behavior. Tests are also added that + demonstrate this particular oddity. + + Newer APIs exist that can be used for some, but not all, Diffie-Hellman + operations (e.g., crypto.diffieHellman() that was added in 2020). We + should keep modernizing crypto APIs, but that is a non-goal for this + security release. + + The ECDH class mirrors the DiffieHellman class in many ways, but it does + not appear to be affected by this particular peculiarity. In particular, + ecdh.generateKeys() does appear to always generate a new private key. + + PR-URL: https://github.com/nodejs-private/node-private/pull/426 + Reviewed-By: Rafael Gonzaga + Reviewed-By: Ben Noordhuis + CVE-ID: CVE-2023-30590 + +Index: node-v12.22.12/doc/api/crypto.md +=================================================================== +--- node-v12.22.12.orig/doc/api/crypto.md ++++ node-v12.22.12/doc/api/crypto.md +@@ -632,12 +632,17 @@ added: v0.5.0 + * `encoding` {string} The [encoding][] of the return value. + * Returns: {Buffer | string} + +-Generates private and public Diffie-Hellman key values, and returns ++Generates private and public Diffie-Hellman key values unless they have been ++generated or computed already, and returns + the public key in the specified `encoding`. This key should be + transferred to the other party. + If `encoding` is provided a string is returned; otherwise a + [`Buffer`][] is returned. + ++This function is a thin wrapper around [`DH_generate_key()`][]. In particular, ++once a private key has been generated or set, calling this function only updates ++the public key but does not generate a new private key. ++ + ### `diffieHellman.getGenerator([encoding])` +