romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 23:53:43 +03:00
Code Issues Projects Releases Packages Wiki Activity

curl: fix --local-port integer overflow

Browse source 
The tool's local port command line range parser didn't check for integer
overflows and could pass "weird" data to libcurl for this option.
libcurl however, has a strict range check for the values so it rejects
anything outside of the accepted range.

Reported-by: Brian Carpenter
Closes #3242
This commit is contained in:
Daniel Stenberg 2018-11-05 11:57:29 +01:00
parent bda4ef417a
commit 52db54869e
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 27 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/tool_operate.c
View file

@ -1371,9 +1371,8 @@ static CURLcode operate_do(struct GlobalConfig *global,
/* curl 7.15.2 */
if(config->localport) {
my_setopt(curl, CURLOPT_LOCALPORT, (long)config->localport);
my_setopt_str(curl, CURLOPT_LOCALPORTRANGE,
(long)config->localportrange);
my_setopt(curl, CURLOPT_LOCALPORT, config->localport);
my_setopt_str(curl, CURLOPT_LOCALPORTRANGE, config->localportrange);
}
/* curl 7.15.5 */