romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-20 17:03:54 +03:00
Code Issues Projects Releases Packages Wiki Activity

vtls: alpn setting, check proto parameter

Browse source 
When setting the negotiated alpn protocol, either then length
must be 0 or a pointer must be passed.

Reported in Joshua's sarif data

Closes #18717
This commit is contained in:
Stefan Eissing 2025-09-25 11:15:15 +02:00 • committed by Daniel Stenberg
parent ccd2b03b0d
commit cbc30d4ed2
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
lib/vtls/vtls.c
View file

@ -1993,6 +1993,11 @@ CURLcode Curl_alpn_set_negotiated(struct Curl_cfilter *cf,
result = CURLE_SSL_CONNECT_ERROR;
goto out;
}
else if(!proto) {
DEBUGASSERT(0); /* with length, we need a pointer */
result = CURLE_SSL_CONNECT_ERROR;
goto out;
}
else if((strlen(connssl->negotiated.alpn) != proto_len) ||
memcmp(connssl->negotiated.alpn, proto, proto_len)) {
failf(data, "ALPN: asked for '%s' from previous session, but server "