romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-04-14 22:21:41 +03:00
Code Issues Projects Releases Packages Wiki Activity

setopt: refuse blobs with zero length

Browse source 
A blob must have a length or it will not be accepted. By enforcing the
check here, TLS backend code can rely on the fact that the length is
always non-zero from this point.

Reported-by: aisle-research-bot
URL: https://github.com/curl/curl/pull/20689#pullrequestreview-3846390367
Closes #20705
This commit is contained in:
Daniel Stenberg 2026-02-24 11:01:35 +01:00
parent 9d94b1a066
commit 956e1ae84f
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/setopt.c
View file

@ -107,7 +107,7 @@ CURLcode Curl_setblobopt(struct curl_blob **blobp,
if(blob) {
struct curl_blob *nblob;
if(blob->len > CURL_MAX_INPUT_LENGTH)
if(!blob->len || (blob->len > CURL_MAX_INPUT_LENGTH))
return CURLE_BAD_FUNCTION_ARGUMENT;
nblob = (struct curl_blob *)
curlx_malloc(sizeof(struct curl_blob) +