romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 09:43:32 +03:00
Code Issues Projects Releases Packages Wiki Activity

urlapi: stricter CURLUPART_PORT parsing

Browse source 
Only allow well formed decimal numbers in the input.

Document that the number MUST be between 1 and 65535.

Add tests to test 1560 to verify the above.

Ref: https://github.com/curl/curl/issues/3753
Closes #3762
This commit is contained in:
Daniel Stenberg 2019-04-11 13:20:15 +02:00
parent 79c4864a56
commit d715d2ac89
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 80 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

11
lib/urlapi.c
View file

@ -1145,6 +1145,7 @@ CURLUcode curl_url_set(CURLU *u, CURLUPart what,
storep = &u->host;
break;
case CURLUPART_PORT:
u->portnum = 0;
storep = &u->port;
break;
case CURLUPART_PATH:
@ -1188,12 +1189,18 @@ CURLUcode curl_url_set(CURLU *u, CURLUPart what,
storep = &u->host;
break;
case CURLUPART_PORT:
{
char *endp;
urlencode = FALSE; /* never */
port = strtol(part, NULL, 10); /* Port number must be decimal */
port = strtol(part, &endp, 10); /* Port number must be decimal */
if((port <= 0) || (port > 0xffff))
return CURLUE_BAD_PORT_NUMBER;
if(*endp)
/* weirdly provided number, not good! */
return CURLUE_MALFORMED_INPUT;
storep = &u->port;
break;
}
break;
case CURLUPART_PATH:
urlskipslash = TRUE;
storep = &u->path;