romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-23 21:47:34 +03:00
Code Issues Projects Releases Packages Wiki Activity

urlapi: reject short file URLs

Browse source 
file URLs that are 6 bytes or shorter are not complete. Return
CURLUE_MALFORMED_INPUT for those. Extended test 1560 to verify.

Triggered by #8041
Closes #8042
This commit is contained in:
Daniel Stenberg 2021-11-22 10:11:59 +01:00
parent ffb6a9e8a6
commit 3e6eb18fce
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
lib/urlapi.c
View file

@ -824,6 +824,10 @@ static CURLUcode seturl(const char *url, CURLU *u, unsigned int flags)
/* handle the file: scheme */
if(url_has_scheme && !strcmp(schemebuf, "file")) {
if(urllen <= 6)
/* file:/ is not enough to actually be a complete file: URL */
return CURLUE_MALFORMED_INPUT;
/* path has been allocated large enough to hold this */
strcpy(path, &url[5]);