romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-31 22:08:05 +03:00
Code Issues Projects Releases Packages Wiki Activity

gopher: reject CR and LF in the selector

Browse source 
Verifed in test 1609

Closes #22116
This commit is contained in:
alhudz 2026-06-20 15:02:19 +05:30 • committed by Daniel Stenberg
parent d786a85f19
commit 65d8eaeaa2
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 49 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

10
lib/gopher.c
View file

@ -103,6 +103,16 @@ static CURLcode gopher_do(struct Curl_easy *data, bool *done)
if(result)
return result;
buf = buf_alloc;
/* A decoded CR or LF would terminate the single-line gopher request and
let a crafted URL smuggle additional bytes onto the wire. REJECT_ZERO
only blocks NUL; reject CR and LF here too. A TAB is left alone as it
is the legitimate gopher type-7 selector/search separator. */
if(memchr(buf, '\r', buf_len) || memchr(buf, '\n', buf_len)) {
curlx_free(buf_alloc);
failf(data, "Bad gopher selector, CR or LF not allowed");
return CURLE_URL_MALFORMAT;
}
}
for(; buf_len;) {