romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 14:53:34 +03:00
Code Issues Projects Releases Packages Wiki Activity

curl: detect and bail out early on parameter integer overflows

Browse source 
Make the number parser aware of the maximum limit curl accepts for a
value and return an error immediately if larger, instead of running an
integer overflow later.

Fixes #1730
Closes #1736
This commit is contained in:
Daniel Stenberg 2017-08-06 20:10:40 +02:00
parent 453e7a7a03
commit 5c7455fe76
5 changed files with 36 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/tool_getparam.c
View file

@ -545,7 +545,8 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */
GetStr(&config->oauth_bearer, nextarg);
break;
case 'c': /* connect-timeout */
err = str2udouble(&config->connecttimeout, nextarg);
err = str2udouble(&config->connecttimeout, nextarg,
LONG_MAX/1000);
if(err)
return err;
break;
@ -1047,7 +1048,7 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */
return err;
break;
case 'R': /* --expect100-timeout */
err = str2udouble(&config->expect100timeout, nextarg);
err = str2udouble(&config->expect100timeout, nextarg, LONG_MAX/1000);
if(err)
return err;
break;
@ -1713,7 +1714,7 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */
break;
case 'm':
/* specified max time */
err = str2udouble(&config->timeout, nextarg);
err = str2udouble(&config->timeout, nextarg, LONG_MAX/1000);
if(err)
return err;
break;