romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-04 20:16:15 +03:00
Code Issues Projects Releases Packages Wiki Activity

c_escape: escape '?' in generated --libcurl code

Browse source 
In order to avoid the risk of it being used in an accidental trigraph in
the generated code.

Reported-by: Harry Sintonen
Bug: https://hackerone.com/reports/1548535
Closes #8742
This commit is contained in:
Daniel Stenberg 2022-04-25 00:29:22 +02:00
parent cdb9b09793
commit 60452236fa
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 7 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/tool_setopt.c
View file

@ -273,6 +273,12 @@ static char *c_escape(const char *str, curl_off_t len)
strcpy(e, "\\\"");
e += 2;
}
else if(c == '?') {
/* escape question marks as well, to prevent generating accidental
trigraphs */
strcpy(e, "\\?");
e += 2;
}
else if(!isprint(c)) {
msnprintf(e, 5, "\\x%02x", (unsigned)c);
e += 4;