fix infinite loop when parsing specially-crafted headers (#521)

pkg/headers/keyval.go

@@ -49,19 +49,17 @@ func keyValParse(str string, separator byte) (map[string]string, error) {
 		var k string
 		k, str = readKey(str, separator)
 
-		if len(k) > 0 {
+		if len(str) > 0 && str[0] == '=' {
-			if len(str) > 0 && str[0] == '=' {
+			var v string
-				var v string
+			var err error
-				var err error
+			v, str, err = readValue(origstr, str[1:], separator)
-				v, str, err = readValue(origstr, str[1:], separator)
+			if err != nil {
-				if err != nil {
+				return nil, err
-					return nil, err
-				}
-
-				ret[k] = v
-			} else {
-				ret[k] = ""
 			}
+
+			ret[k] = v
+		} else {
+			ret[k] = ""
 		}
 
 		// skip separator

pkg/headers/keyval_test.go

@@ -85,21 +85,8 @@ func TestKeyValParse(t *testing.T) {
 	}
 }
 
-func TestKeyValParseErrors(t *testing.T) {
+func FuzzKeyValParse(f *testing.F) {
-	for _, ca := range []struct {
+	f.Fuzz(func(t *testing.T, b string) {
-		name string
+		keyValParse(b, ',') //nolint:errcheck
-		s    string
+	})
-		err  string
-	}{
-		{
-			"apexes not closed",
-			`key1="v,1`,
-			"apexes not closed (key1=\"v,1)",
-		},
-	} {
-		t.Run(ca.name, func(t *testing.T) {
-			_, err := keyValParse(ca.s, ',')
-			require.EqualError(t, err, ca.err)
-		})
-	}
 }

pkg/headers/testdata/fuzz/FuzzKeyValParse/15422aae47040b82

@@ -0,0 +1,2 @@
+go test fuzz v1
+string("=\"")

pkg/headers/testdata/fuzz/FuzzKeyValParse/32a837cd12bd2cfa

@@ -0,0 +1,2 @@
+go test fuzz v1
+string("=\x84")