romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-05-16 18:56:21 +03:00
Code Issues Projects Releases Packages Wiki Activity

tool_urlglob: check glob use before access

Browse source 
As this function can now be invoked with only the second glob "active",
it must avoid accessing the first one if not in use.

Follow-up to 2238f0921c

Spotted by Codex Security

Closes #21586
This commit is contained in:
Daniel Stenberg 2026-05-13 12:41:51 +02:00
parent 2238f0921c
commit b2476a0712
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/tool_urlglob.c
View file

@ -716,7 +716,7 @@ CURLcode glob_match_url(char **output, const char *filename,
while(*filename) {
CURLcode result = CURLE_OK;
struct URLPattern *pat = NULL;
if(*filename == '#' && ISDIGIT(filename[1])) {
if(glob_inuse(glob) && *filename == '#' && ISDIGIT(filename[1])) {
/* a numbered glob reference */
const char *ptr = filename++;
curl_off_t num;