romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 02:53:32 +03:00
Code Issues Projects Releases Packages Wiki Activity

urlapi: fix use-after-free bug

Browse source 
Follow-up from 2c20109a9b

Added test 663 to verify.

Reported by OSS-Fuzz
Bug: https://crbug.com/oss-fuzz/17954

Closes #4453
This commit is contained in:
Daniel Stenberg 2019-10-03 13:24:43 +02:00
parent 13ecc0725f
commit 02c6b984cb
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 116 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/data/Makefile.inc
View file

@ -84,7 +84,7 @@ test626 test627 test628 test629 test630 test631 test632 test633 test634 \
test635 test636 test637 test638 test639 test640 test641 test642 \
test643 test644 test645 test646 test647 test648 test649 test650 test651 \
test652 test653 test654 test655 test656 test658 test659 test660 test661 \
test662 \
test662 test663 \
\
test700 test701 test702 test703 test704 test705 test706 test707 test708 \
test709 test710 test711 test712 test713 test714 test715 test716 test717 \

79
tests/data/test663 Normal file
View file

@ -0,0 +1,79 @@
#
# This test is crafted to reproduce oss-fuzz bug
# https://crbug.com/oss-fuzz/17954
#
<testcase>
<info>
<keywords>
HTTP
HTTP GET
followlocation
</keywords>
</info>
#
# Server-side
<reply>
<data>
HTTP/1.1 302 OK
Location: http://example.net/there/it/is/../../tes t case=/6630002? yes no
Date: Thu, 09 Nov 2010 14:49:00 GMT
Content-Length: 0
</data>
<data2>
HTTP/1.1 200 OK
Location: this should be ignored
Date: Thu, 09 Nov 2010 14:49:00 GMT
Content-Length: 5
body
</data2>
<datacheck>
HTTP/1.1 302 OK
Location: http://example.net/there/it/is/../../tes t case=/6630002? yes no
Date: Thu, 09 Nov 2010 14:49:00 GMT
Content-Length: 0
HTTP/1.1 200 OK
Location: this should be ignored
Date: Thu, 09 Nov 2010 14:49:00 GMT
Content-Length: 5
body
</datacheck>
</reply>
#
# Client-side
<client>
<server>
http
</server>
<name>
HTTP redirect with dotdots and whitespaces in absolute Location: URL
</name>
<command>
http://example.com/please/../gimme/663?foobar#hello -L -x http://%HOSTIP:%HTTPPORT
</command>
</client>
#
# Verify data after the test has been "shot"
<verify>
<strip>
^User-Agent:.*
</strip>
<protocol>
GET http://example.com/gimme/663?foobar HTTP/1.1
Host: example.com
Accept: */*
Proxy-Connection: Keep-Alive
GET http://example.net/there/tes%20t%20case=/6630002?+yes+no HTTP/1.1
Host: example.net
Accept: */*
Proxy-Connection: Keep-Alive
</protocol>
</verify>
</testcase>