romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-05-30 12:47:29 +03:00
Code Issues Projects Releases Packages Wiki Activity

socks: do_SOCKS5: Fix invalid buffer content on short send

Browse source 
Ahmad Gani intercepts the sendto syscall to simulate short send, but
curl incorrectly handles it. It keeps resending the version:

  sendto(4, "\x05", 1, MSG_NOSIGNAL, NULL, 0) = 1
  sendto(4, "\x05", 1, MSG_NOSIGNAL, NULL, 0) = 1

Don't restart the buffer in the `CONNECT_SOCKS_INIT` case if
`sx->outstanding` is not zero. It should continue sending the
advanced buffer.

Fixes #17942
Reported-by: Ahmad Gani <reyuki@gnuweeb.org>
Signed-off-by: Ammar Faizi <ammarfaizi2@gnuweeb.org>
Closes #17943
This commit is contained in:
Ammar Faizi 2025-07-16 20:22:43 +07:00 • committed by Daniel Stenberg
parent bfa317c8cd
commit 5cefe93eb6
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 16 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

29
lib/socks.c
View file

@ -591,20 +591,23 @@ static CURLproxycode do_SOCKS5(struct Curl_cfilter *cf,
allow_gssapi = TRUE;
#endif
idx = 0;
socksreq[idx++] = 5; /* version */
idx++; /* number of authentication methods */
socksreq[idx++] = 0; /* no authentication */
if(allow_gssapi)
socksreq[idx++] = 1; /* GSS-API */
if(sx->proxy_user)
socksreq[idx++] = 2; /* username/password */
/* write the number of authentication methods */
socksreq[1] = (unsigned char) (idx - 2);
if(!sx->outstanding) {
idx = 0;
socksreq[idx++] = 5; /* version */
idx++; /* number of authentication methods */
socksreq[idx++] = 0; /* no authentication */
if(allow_gssapi)
socksreq[idx++] = 1; /* GSS-API */
if(sx->proxy_user)
socksreq[idx++] = 2; /* username/password */
/* write the number of authentication methods */
socksreq[1] = (unsigned char) (idx - 2);
sx->outp = socksreq;
DEBUGASSERT(idx <= sizeof(sx->buffer));
sx->outstanding = idx;
}
sx->outp = socksreq;
DEBUGASSERT(idx <= sizeof(sx->buffer));
sx->outstanding = idx;
presult = socks_state_send(cf, sx, data, CURLPX_SEND_CONNECT,
"initial SOCKS5 request");
if(CURLPX_OK != presult)