romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 20:53:54 +03:00
Code Issues Projects Releases Packages Wiki Activity

glob: do not continue parsing after a strtoul() overflow range

Browse source 
Added test 1289 to verify.

CVE-2017-1000101

Bug: https://curl.haxx.se/docs/adv_20170809A.html
Reported-by: Brian Carpenter
This commit is contained in:
Daniel Stenberg 2017-08-01 17:16:07 +02:00
parent 358b2b131a
commit 453e7a7a03
3 changed files with 40 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/tool_urlglob.c
View file

@ -273,7 +273,10 @@ static CURLcode glob_range(URLGlob *glob, char **patternp,
}
errno = 0;
max_n = strtoul(pattern, &endp, 10);
if(errno || (*endp == ':')) {
if(errno)
/* overflow */
endp = NULL;
else if(*endp == ':') {
pattern = endp+1;
errno = 0;
step_n = strtoul(pattern, &endp, 10);