romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 15:13:41 +03:00
Code Issues Projects Releases Packages Wiki Activity

parsedate: handle cut off numbers better

Browse source 
... and don't read outside of the given buffer!

CVE-2016-8621

bug: https://curl.haxx.se/docs/adv_20161102G.html
Reported-by: Luật Nguyễn
This commit is contained in:
Daniel Stenberg 2016-10-04 16:59:38 +02:00
parent 46133aa536
commit 96a80b5a26
3 changed files with 20 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

12
lib/parsedate.c
View file

@ -5,7 +5,7 @@
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
* Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al.
* Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
@ -386,15 +386,17 @@ static int parsedate(const char *date, time_t *output)
/* a digit */
int val;
char *end;
int len=0;
if((secnum == -1) &&
(3 == sscanf(date, "%02d:%02d:%02d", &hournum, &minnum, &secnum))) {
(3 == sscanf(date, "%02d:%02d:%02d%n",
&hournum, &minnum, &secnum, &len))) {
/* time stamp! */
date += 8;
date += len;
}
else if((secnum == -1) &&
(2 == sscanf(date, "%02d:%02d", &hournum, &minnum))) {
(2 == sscanf(date, "%02d:%02d%n", &hournum, &minnum, &len))) {
/* time stamp without seconds */
date += 5;
date += len;
secnum = 0;
}
else {