romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-05-01 16:27:52 +03:00
Code Issues Projects Releases Packages Wiki Activity

formdata: validate callback is non-NULL before use

Browse source 
curl_formget() accepts a user-provided callback function but does not
validate it is non-NULL before calling it. If a caller passes NULL,
the function will crash with SIGSEGV.

Add NULL check at the start of the function to return an appropriate
error code instead of crashing.

Signed-off-by: Robert W. Van Kirk <robert@rwvk.tech>
Closes #19858
This commit is contained in:
Robert W. Van Kirk 2025-12-06 12:00:00 -06:00 • committed by Daniel Stenberg
parent 891566c72d
commit 1c0822e8cb
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
lib/formdata.c
View file

@ -636,6 +636,10 @@ int curl_formget(struct curl_httppost *form, void *arg,
CURLcode result;
curl_mimepart toppart;
/* Validate callback is provided */
if(!append)
return (int)CURLE_BAD_FUNCTION_ARGUMENT;
Curl_mime_initpart(&toppart); /* default form is empty */
result = Curl_getformdata(NULL, &toppart, form, NULL);
if(!result)