romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-24 18:57:18 +03:00
Code Issues Projects Releases Packages Wiki Activity

urlapi: verify the last letter of a scheme when set explictly

Browse source 
A logic error made the function not check the last character, which thus
could make it accept invalid schemes.

Added test 1965 to verify

Reported-by: Otis Cui Lei

Closes #20893
This commit is contained in:
Daniel Stenberg 2026-03-11 22:36:24 +01:00
parent 5fc7d50cec
commit 11c14b5ca5
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
5 changed files with 103 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

1
lib/urlapi.c
View file

@ -1649,6 +1649,7 @@ static CURLUcode set_url_scheme(CURLU *u, const char *scheme,
const char *s = scheme;
if(ISALPHA(*s)) {
/* ALPHA *( ALPHA / DIGIT / "+" / "-" / "." ) */
s++;
while(--plen) {
if(ISALNUM(*s) || (*s == '+') || (*s == '-') || (*s == '.'))
s++; /* fine */