romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-24 14:07:16 +03:00
Code Issues Projects Releases Packages Wiki Activity

formadd: wrong pointer for file name when CURLFORM_BUFFERPTR used

Browse source 
The internal function that's used to detect known file extensions for
the default Content-Type got the the wrong pointer passed in when
CURLFORM_BUFFER + CURLFORM_BUFFERPTR were used. This had the effect that
strlen() would be used which could lead to an out-of-bounds read (and
thus segfault). In most cases it would only lead to it not finding or
using the correct default content-type.

It also showed that test 554 and test 587 were testing for the
previous/wrong behavior and now they're updated as well.

Bug: http://curl.haxx.se/bug/view.cgi?id=1262
Reported-by: Konstantin Isakov
This commit is contained in:
Daniel Stenberg 2013-08-04 23:27:27 +02:00
parent 51f0b798fa
commit 0ddc678927
3 changed files with 10 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

12
lib/formdata.c
View file

@ -168,8 +168,8 @@ static FormInfo * AddFormInfo(char *value,
* Returns some valid contenttype for filename.
*
***************************************************************************/
static const char * ContentTypeForFilename (const char *filename,
const char *prevtype)
static const char *ContentTypeForFilename(const char *filename,
const char *prevtype)
{
const char *contenttype = NULL;
unsigned int i;
@ -178,7 +178,7 @@ static const char * ContentTypeForFilename (const char *filename,
* extensions and pick the first we match!
*/
struct ContentType {
char extension[6];
const char *extension;
const char *type;
};
static const struct ContentType ctts[]={
@ -667,9 +667,11 @@ CURLFORMcode FormAdd(struct curl_httppost **httppost,
if(((form->flags & HTTPPOST_FILENAME) ||
(form->flags & HTTPPOST_BUFFER)) &&
!form->contenttype ) {
char *f = form->flags & HTTPPOST_BUFFER?
form->showfilename : form->value;
/* our contenttype is missing */
form->contenttype
= strdup(ContentTypeForFilename(form->value, prevtype));
form->contenttype = strdup(ContentTypeForFilename(f, prevtype));
if(!form->contenttype) {
return_value = CURL_FORMADD_MEMORY;
break;