Tinyproxy - HTTP Request Smuggling via Duplicate Content-Length Headers

A remote attacker sends an HTTP request containing multiple `Content-Length` headers with different values (e.g., `Content-Length: 5` and `Content-Length: 100`). Tinyproxy uses the first value to read the request body but forwards all duplicate headers to the backend. The backend interprets the last `Content-Length` value, causing a mismatch in body size. The extra bytes beyond the first value are treated by the backend as the start of a new HTTP request, enabling request smuggling. [CWE-444] [ref_id=1]

The vulnerability is in `src/reqs.c` in the `add_header_to_connection` function and the `pseudomap_append` / `pseudomap_find_index` functions in `src/pseudomap.c`. The proxy forwards all duplicate Content-Length headers to the backend without rejecting requests that contain multiple differing values, and uses only the first value to determine how many body bytes to consume. [ref_id=1]

The patch in commit 364cdb6 adds a check in `add_header_to_connection` (in `src/reqs.c`) that detects when a `Content-Length` header is about to be inserted and the `content-length` key already exists in the header hash map. If a duplicate is found, the function returns 0 without appending the duplicate header, preventing multiple Content-Length headers from being forwarded to the backend. This closes the desync vector described in Finding 2 of the advisory. [patch_id=6466820] [ref_id=1]