romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-01 10:38:04 +03:00
Code Issues Projects Releases Packages Wiki Activity

curl_url_set: enforce the max string length check for all parts

Browse source 
Update the docs and test 1559 accordingly

Closes #11273
This commit is contained in:
Daniel Stenberg 2023-06-08 13:40:52 +02:00
parent 67e9e90f96
commit dacd25888f
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 10 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

14
lib/urlapi.c
View file

@ -1642,6 +1642,7 @@ CURLUcode curl_url_set(CURLU *u, CURLUPart what,
bool leadingslash = FALSE;
bool appendquery = FALSE;
bool equalsencode = FALSE;
size_t nalloc;
if(!u)
return CURLUE_BAD_HANDLE;
@ -1694,6 +1695,11 @@ CURLUcode curl_url_set(CURLU *u, CURLUPart what,
return CURLUE_OK;
}
nalloc = strlen(part);
if(nalloc > CURL_MAX_INPUT_LENGTH)
/* excessive input length */
return CURLUE_MALFORMED_INPUT;
switch(what) {
case CURLUPART_SCHEME: {
size_t plen = strlen(part);
@ -1800,14 +1806,8 @@ CURLUcode curl_url_set(CURLU *u, CURLUPart what,
}
DEBUGASSERT(storep);
{
const char *newp = part;
size_t nalloc = strlen(part);
const char *newp;
struct dynbuf enc;
if(nalloc > CURL_MAX_INPUT_LENGTH)
/* excessive input length */
return CURLUE_MALFORMED_INPUT;
Curl_dyn_init(&enc, nalloc * 3 + 1 + leadingslash);
if(leadingslash && (part[0] != '/')) {