romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-27 22:23:08 +03:00
Code Issues Projects Releases Packages Wiki Activity

urlapi: prevent a terminal .0x component to normalize IPv4

Browse source 
Extend test 1560 to verify

Follow-up to 831a151484

Spotted by Codex Security
Closes #21652
This commit is contained in:
Daniel Stenberg 2026-05-17 00:27:30 +02:00
parent 7bde6cb9fc
commit d74c0ada4e
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/urlapi.c
View file

@ -523,6 +523,8 @@ UNITTEST int ipv4_normalize(struct dynbuf *host)
if(c[1] == 'x') {
c += 2; /* skip the prefix */
rc = curlx_str_hex(&c, &l, UINT_MAX);
if(rc)
return HOST_NAME;
}
else
rc = curlx_str_octal(&c, &l, UINT_MAX);