Backport of CVE 2024 22019 for v14.x

deps/llhttp/.gitignore

@@ -0,0 +1 @@
+libllhttp.pc

deps/llhttp/CMakeLists.txt

@@ -0,0 +1,115 @@
+cmake_minimum_required(VERSION 3.5.1)
+cmake_policy(SET CMP0069 NEW)
+
+project(llhttp VERSION 6.1.0)
+include(GNUInstallDirs)
+
+set(CMAKE_C_STANDARD 99)
+
+# By default build in relwithdebinfo type, supports both lowercase and uppercase
+if(NOT CMAKE_CONFIGURATION_TYPES)
+  set(allowableBuildTypes DEBUG RELEASE RELWITHDEBINFO MINSIZEREL)
+  set_property(CACHE CMAKE_BUILD_TYPE PROPERTY STRINGS "${allowableBuildTypes}")
+  if(NOT CMAKE_BUILD_TYPE)
+  set(CMAKE_BUILD_TYPE RELWITHDEBINFO CACHE STRING "" FORCE)
+  else()
+    string(TOUPPER ${CMAKE_BUILD_TYPE} CMAKE_BUILD_TYPE)
+    if(NOT CMAKE_BUILD_TYPE IN_LIST allowableBuildTypes)
+      message(FATAL_ERROR "Invalid build type: ${CMAKE_BUILD_TYPE}")
+    endif()
+  endif()
+endif()
+
+#
+# Options
+#
+# Generic option
+option(BUILD_SHARED_LIBS "Build shared libraries (.dll/.so)" ON)
+option(BUILD_STATIC_LIBS "Build static libraries (.lib/.a)" OFF)
+
+# Source code
+set(LLHTTP_SOURCES
+  ${CMAKE_CURRENT_SOURCE_DIR}/src/llhttp.c
+  ${CMAKE_CURRENT_SOURCE_DIR}/src/http.c
+  ${CMAKE_CURRENT_SOURCE_DIR}/src/api.c
+)
+
+set(LLHTTP_HEADERS
+  ${CMAKE_CURRENT_SOURCE_DIR}/include/llhttp.h
+)
+
+configure_file(
+  ${CMAKE_CURRENT_SOURCE_DIR}/libllhttp.pc.in
+  ${CMAKE_CURRENT_SOURCE_DIR}/libllhttp.pc
+  @ONLY
+)
+
+function(config_library target)
+  target_sources(${target} PRIVATE ${LLHTTP_SOURCES} ${LLHTTP_HEADERS})
+
+  target_include_directories(${target} PRIVATE
+      ${CMAKE_CURRENT_SOURCE_DIR}/include
+  )
+
+  set_target_properties(${target} PROPERTIES
+    OUTPUT_NAME llhttp
+    VERSION ${PROJECT_VERSION}
+    SOVERSION ${PROJECT_VERSION_MAJOR}.${PROJECT_VERSION_MINOR}
+    PUBLIC_HEADER ${LLHTTP_HEADERS}
+  )
+
+  install(TARGETS ${target}
+    EXPORT llhttp
+    LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
+    ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}
+    PUBLIC_HEADER DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
+  )
+
+  install(FILES
+    ${CMAKE_CURRENT_SOURCE_DIR}/libllhttp.pc
+    DESTINATION ${CMAKE_INSTALL_LIBDIR}/pkgconfig
+  )
+
+  # This is required to work with FetchContent
+  install(EXPORT llhttp
+        FILE llhttp-config.cmake
+        NAMESPACE llhttp::
+        DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/llhttp)
+endfunction(config_library target)
+
+if(BUILD_SHARED_LIBS)
+  add_library(llhttp_shared SHARED
+      ${llhttp_src}
+  )
+  add_library(llhttp::llhttp ALIAS llhttp_shared)
+  config_library(llhttp_shared)
+endif()
+
+if(BUILD_STATIC_LIBS)
+  add_library(llhttp_static STATIC
+      ${llhttp_src}
+  )
+  if(BUILD_SHARED_LIBS)
+    add_library(llhttp::llhttp ALIAS llhttp_shared)
+  else()
+    add_library(llhttp::llhttp ALIAS llhttp_static)
+  endif()
+  config_library(llhttp_static)
+endif()
+
+# On windows with Visual Studio, add a debug postfix so that release
+# and debug libraries can coexist.
+if(MSVC)
+  set(CMAKE_DEBUG_POSTFIX "d")
+endif()
+
+# Print project configure summary
+message(STATUS "")
+message(STATUS "")
+message(STATUS "Project configure summary:")
+message(STATUS "")
+message(STATUS "  CMake build type .................: ${CMAKE_BUILD_TYPE}")
+message(STATUS "  Install prefix ...................: ${CMAKE_INSTALL_PREFIX}")
+message(STATUS "  Build shared library .............: ${BUILD_SHARED_LIBS}")
+message(STATUS "  Build static library .............: ${BUILD_STATIC_LIBS}")
+message(STATUS "")

deps/llhttp/README.md

@@ -1,4 +1,5 @@
 # llhttp
+[![CI](https://github.com/nodejs/llhttp/workflows/CI/badge.svg)](https://github.com/nodejs/llhttp/actions?query=workflow%3ACI)
 
 Port of [http_parser][0] to [llparse][1].
 
@@ -22,7 +23,7 @@ were tried. However, all of them failed due to resulting significant performance
 degradation.
 
 This project is a port of [http_parser][0] to TypeScript. [llparse][1] is used
-to generate the output C and/or bitcode artifacts, which could be compiled and
+to generate the output C source file, which could be compiled and
 linked with the embedder's program (like [Node.js][7]).
 
 ## Performance
@@ -31,7 +32,7 @@ So far llhttp outperforms http_parser:
 
 |                 | input size |  bandwidth   |  reqs/sec  |   time  |
 |:----------------|-----------:|-------------:|-----------:|--------:|
-| **llhttp** _(C)_ | 8192.00 mb | 1777.24 mb/s | 3583799.39 ops/sec | 4.61 s |
+| **llhttp**      | 8192.00 mb | 1777.24 mb/s | 3583799.39 req/sec | 4.61 s |
 | **http_parser** | 8192.00 mb | 694.66 mb/s | 1406180.33 req/sec | 11.79 s |
 
 llhttp is faster by approximately **156%**.
@@ -89,9 +90,60 @@ if (err == HPE_OK) {
           parser.reason);
 }
 ```
+For more information on API usage, please refer to [src/native/api.h](https://github.com/nodejs/llhttp/blob/main/src/native/api.h).
+
+## Build Instructions
+
+Make sure you have [Node.js](https://nodejs.org/), npm and npx installed. Then under project directory run:
+
+```sh
+npm install
+make
+```
 
 ---
 
+### Bindings to other languages
+
+* Python: [pallas/pyllhttp][8]
+* Ruby: [metabahn/llhttp][9]
+* Rust: [JackLiar/rust-llhttp][10]
+
+### Using with CMake
+
+If you want to use this library in a CMake project you can use the snippet below.
+
+```
+FetchContent_Declare(llhttp
+  URL "https://github.com/nodejs/llhttp/archive/refs/tags/v6.0.5.tar.gz")  # Using version 6.0.5
+
+FetchContent_MakeAvailable(llhttp)
+
+target_link_libraries(${EXAMPLE_PROJECT_NAME} ${PROJECT_LIBRARIES} llhttp ${PROJECT_NAME})
+```
+
+## Building on Windows
+
+### Installation
+
+* `choco install git`
+* `choco install node`
+* `choco install llvm` (or install the `C++ Clang tools for Windows` optional package from the Visual Studio 2019 installer)
+* `choco install make` (or if you have MinGW, it comes bundled)
+
+1. Ensure that `Clang` and `make` are in your system path.
+2. Using Git Bash, clone the repo to your preferred location.
+3. Cd into the cloned directory and run `npm install`
+5. Run `make`
+6. Your `repo/build` directory should now have `libllhttp.a` and `libllhttp.so` static and dynamic libraries.
+7. When building your executable, you can link to these libraries. Make sure to set the build folder as an include path when building so you can reference the declarations in `repo/build/llhttp.h`.
+
+### A simple example on linking with the library:
+
+Assuming you have an executable `main.cpp` in your current working directory, you would run: `clang++ -Os -g3 -Wall -Wextra -Wno-unused-parameter -I/path/to/llhttp/build main.cpp /path/to/llhttp/build/libllhttp.a -o main.exe`.
+
+If you are getting `unresolved external symbol` linker errors you are likely attempting to build `llhttp.c` without linking it with object files from `api.c` and `http.c`.
+
 #### LICENSE
 
 This software is licensed under the MIT License.
@@ -125,3 +177,6 @@ USE OR OTHER DEALINGS IN THE SOFTWARE.
 [5]: https://llvm.org/docs/LangRef.html#call-instruction
 [6]: https://clang.llvm.org/
 [7]: https://github.com/nodejs/node
+[8]: https://github.com/pallas/pyllhttp
+[9]: https://github.com/metabahn/llhttp
+[10]: https://github.com/JackLiar/rust-llhttp