romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-23 13:27:17 +03:00
Code Issues Projects Releases Packages Wiki Activity

urlapi: make sure no +/- signs are accepted in IPv4 numericals

Browse source 
Follow-up to 56a037cc0a. Extends test 1560 to verify.

Reported-by: Tuomas Siipola
Fixes #6916
Closes #6917
This commit is contained in:
Daniel Stenberg 2021-04-19 22:58:54 +02:00
parent 9cb48457c6
commit 04488851e2
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 8 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
lib/urlapi.c
View file

@ -686,7 +686,11 @@ static bool ipv4_normalize(const char *hostname, char *outp, size_t olen)
while(!done) {
char *endp;
unsigned long l = strtoul(c, &endp, 0);
unsigned long l;
if((*c < '0') || (*c > '9'))
/* most importantly this doesn't allow a leading plus or minus */
return FALSE;
l = strtoul(c, &endp, 0);
/* overflow or nothing parsed at all */
if(((l == ULONG_MAX) && (errno == ERANGE)) || (endp == c))