romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 17:33:32 +03:00
Code Issues Projects Releases Packages Wiki Activity

unescape: avoid integer overflow

Browse source 
CVE-2016-8622

Bug: https://curl.haxx.se/docs/adv_20161102H.html
Reported-by: Cure53
This commit is contained in:
Daniel Stenberg 2016-10-04 18:56:45 +02:00
parent c5be3d7267
commit 53e71e47d6
3 changed files with 18 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

10
lib/escape.c
View file

@ -224,8 +224,14 @@ char *curl_easy_unescape(struct Curl_easy *data, const char *string,
FALSE);
if(res)
return NULL;
if(olen)
*olen = curlx_uztosi(outputlen);
if(olen) {
if(outputlen <= (size_t) INT_MAX)
*olen = curlx_uztosi(outputlen);
else
/* too large to return in an int, fail! */
Curl_safefree(str);
}
}
return str;
}