From 454181cd6644c3f6fd6b1b7059dd057b2483ff3e Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Sat, 28 Feb 2026 10:48:59 +0100 Subject: [PATCH] urlapi: typecast CURLU_URLDECODE to uint when toggling it off In this use case 'unsigned value &= ~DEFINE;' As otherwise the right side is treated as signed, which annoyingly triggers UBSan. Reported-by: xmoezzz on github Fixes #20753 --- lib/urlapi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/urlapi.c b/lib/urlapi.c index c59f239756..3c84fcba7f 100644 --- a/lib/urlapi.c +++ b/lib/urlapi.c @@ -1555,7 +1555,7 @@ CURLUcode curl_url_get(const CURLU *u, CURLUPart what, case CURLUPART_SCHEME: ptr = u->scheme; ifmissing = CURLUE_NO_SCHEME; - flags &= ~CURLU_URLDECODE; /* never for schemes */ + flags &= ~(unsigned int)CURLU_URLDECODE; /* never for schemes */ if((flags & CURLU_NO_GUESS_SCHEME) && u->guessed_scheme) return CURLUE_NO_SCHEME; break; @@ -1582,7 +1582,7 @@ CURLUcode curl_url_get(const CURLU *u, CURLUPart what, case CURLUPART_PORT: ptr = u->port; ifmissing = CURLUE_NO_PORT; - flags &= ~CURLU_URLDECODE; /* never for port */ + flags &= ~(unsigned int)CURLU_URLDECODE; /* never for port */ if(!ptr && (flags & CURLU_DEFAULT_PORT) && u->scheme) { /* there is no stored port number, but asked to deliver a default one for the scheme */