romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-15 19:47:16 +03:00
Code Issues Projects Releases Packages Wiki Activity

curl_fnmatch: only allow two asterisks for matching

Browse source 
The previous limit of 5 can still end up in situation that takes a very
long time and consumes a lot of CPU.

If there is still a rare use case for this, a user can provide their own
fnmatch callback for a version that allows a larger set of wildcards.

This commit was triggered by yet another OSS-Fuzz timeout due to this.
Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8369

Closes #2587
This commit is contained in:
Daniel Stenberg 2018-05-18 16:48:13 +02:00
parent 27aebcc1d1
commit 404c8850da
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 3 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/libcurl/opts/CURLOPT_WILDCARDMATCH.3
View file

@ -5,7 +5,7 @@
.\" * | (__| |_| | _ <| |___
.\" * \___|\___/|_| \_\_____|
.\" *
.\" * Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al.
.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
.\" *
.\" * This software is licensed as described in the file COPYING, which
.\" * you should have received as part of this distribution. The terms
@ -41,7 +41,7 @@ A brief introduction of its syntax follows:
.RS
.IP "* - ASTERISK"
\&ftp://example.com/some/path/\fB*.txt\fP (for all txt's from the root
directory)
directory). Only two asterisks are allowed within the same pattern string.
.RE
.RS
.IP "? - QUESTION MARK"