romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-24 13:37:18 +03:00
Code Issues Projects Releases Packages Wiki Activity

Limit ASN.1 structure sizes to 256K. Prevent some allocation size overflows.

Browse source 
See CRL-01-006.
This commit is contained in:
Patrick Monnerat 2016-11-24 14:28:39 +01:00
parent 3e9c0230f4
commit 945f60e8a7
5 changed files with 47 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

24
lib/vauth/cleartext.c
View file

@ -66,16 +66,27 @@ CURLcode Curl_auth_create_plain_message(struct Curl_easy *data,
char *plainauth;
size_t ulen;
size_t plen;
size_t plainlen;
*outlen = 0;
*outptr = NULL;
ulen = strlen(userp);
plen = strlen(passwdp);
plainauth = malloc(2 * ulen + plen + 2);
if(!plainauth) {
*outlen = 0;
*outptr = NULL;
/* Compute binary message length, checking for overflows. */
plainlen = 2 * ulen;
if(plainlen < ulen)
return CURLE_OUT_OF_MEMORY;
plainlen += plen;
if(plainlen < plen)
return CURLE_OUT_OF_MEMORY;
plainlen += 2;
if(plainlen < 2)
return CURLE_OUT_OF_MEMORY;
plainauth = malloc(plainlen);
if(!plainauth)
return CURLE_OUT_OF_MEMORY;
}
/* Calculate the reply */
memcpy(plainauth, userp, ulen);
@ -85,8 +96,7 @@ CURLcode Curl_auth_create_plain_message(struct Curl_easy *data,
memcpy(plainauth + 2 * ulen + 2, passwdp, plen);
/* Base64 encode the reply */
result = Curl_base64_encode(data, plainauth, 2 * ulen + plen + 2, outptr,
outlen);
result = Curl_base64_encode(data, plainauth, plainlen, outptr, outlen);
free(plainauth);
return result;