romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-26 11:13:36 +03:00
Code Issues Projects Releases Packages Wiki Activity

setopt: avoid integer overflows when setting millsecond values

Browse source 
... that are multiplied by 1000 when stored.

For 32 bit long systems, the max value accepted (2147483 seconds) is >
596 hours which is unlikely to ever be set by a legitimate application -
and previously it didn't work either, it just caused undefined behavior.

Also updated the man pages for these timeout options to mention the
return code.

Closes #1938
This commit is contained in:
Daniel Stenberg 2017-10-03 17:00:18 +02:00
parent 4440b6ad57
commit 172ce9cc19
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
4 changed files with 26 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

18
lib/url.c
View file

@ -875,7 +875,11 @@ CURLcode Curl_setopt(struct Curl_easy *data, CURLoption option,
* Option that specifies how quickly an server response must be obtained
* before it is considered failure. For pingpong protocols.
*/
data->set.server_response_timeout = va_arg(param, long) * 1000;
arg = va_arg(param, long);
if((arg>=0) && (arg < (INT_MAX/1000)))
data->set.server_response_timeout = arg * 1000;
else
return CURLE_BAD_FUNCTION_ARGUMENT;
break;
case CURLOPT_TFTP_NO_OPTIONS:
/*
@ -1725,7 +1729,11 @@ CURLcode Curl_setopt(struct Curl_easy *data, CURLoption option,
* The maximum time you allow curl to use for a single transfer
* operation.
*/
data->set.timeout = va_arg(param, long) * 1000L;
arg = va_arg(param, long);
if((arg>=0) && (arg < (INT_MAX/1000)))
data->set.timeout = arg * 1000;
else
return CURLE_BAD_FUNCTION_ARGUMENT;
break;
case CURLOPT_TIMEOUT_MS:
@ -1736,7 +1744,11 @@ CURLcode Curl_setopt(struct Curl_easy *data, CURLoption option,
/*
* The maximum time you allow curl to use to connect.
*/
data->set.connecttimeout = va_arg(param, long) * 1000L;
arg = va_arg(param, long);
if((arg>=0) && (arg < (INT_MAX/1000)))
data->set.connecttimeout = arg * 1000;
else
return CURLE_BAD_FUNCTION_ARGUMENT;
break;
case CURLOPT_CONNECTTIMEOUT_MS: