romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-31 21:48:04 +03:00
Code Issues Projects Releases Packages Wiki Activity

tool_urlglob: avoid overflow at end of range

Browse source 
Due to how the range span globbing code works, a range that ends with
9223372036854775807 (the maximum signed 63 bit value) cannot be used as
it triggers an integer overflow.

Verified in test 2092

Reported-by: Andrew Nesbit
Closes #21529
This commit is contained in:
Daniel Stenberg 2026-05-07 17:45:48 +02:00
parent 9249aad4c2
commit 3ce10063f1
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 33 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/tool_urlglob.c
View file

@ -324,8 +324,10 @@ static CURLcode glob_range(struct URLGlob *glob, const char **patternp,
/* the pattern is not well-formed */
return globerror(glob, "bad range", *posp, CURLE_URL_MALFORMAT);
/* typecasting to ints are fine here since we make sure above that we
are within 31 bits */
if((CURL_OFF_T_MAX - step_n) < max_n)
return globerror(glob, "range end/step overflow", *posp,
CURLE_URL_MALFORMAT);
pat->c.num.idx = pat->c.num.min = min_n;
pat->c.num.max = max_n;
pat->c.num.step = step_n;