romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-03 07:20:28 +03:00
Code Issues Projects Releases Packages Wiki Activity

dnsd: fix bounds check in read_https_alpn_part()

Browse source 
"The check `i > 256` permits `i == 256` to pass through. When `i` is
then cast to `uint8_t` in `blob_add(b, (uint8_t)i)`, the value wraps to
0, silently encoding a zero-length ALPN entry instead of rejecting it.
The condition should be `i > 255` (or equivalently `i >= 256`) to
correctly reject any length that does not fit in a single byte."

Reported by GitHub Code Quality

Follow-up to 86f1e5b3f6 #21299

Closes #22420
This commit is contained in:
Viktor Szakats 2026-07-15 02:28:09 +02:00
parent e2fa29c402
commit 387b4c5e4c
No known key found for this signature in database
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/server/dnsd.c
View file

@ -570,7 +570,7 @@ static int read_https_alpn_part(struct blob *b, struct Curl_str *str)
if(str->str[i] == ',')
break;
}
if(i > 256)
if(i >= 256)
return 1;
if(blob_add(b, (uint8_t)i) || blob_addchars(b, str->str, i))
return 1;