From f7d4e11f4b423a6db61ca86cf59483fad9f4bc13 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Mon, 22 Jun 2026 11:34:10 +0200 Subject: [PATCH] setopt: return error if received `curl_blob->data` is NULL To avoid dereferencing in the function if `CURL_BLOB_COPY` is set, or outside of the function if unset. Reported-by: netspacer.research Closes #22129 --- lib/setopt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/setopt.c b/lib/setopt.c index df054469d4..eb9ff2e396 100644 --- a/lib/setopt.c +++ b/lib/setopt.c @@ -108,7 +108,7 @@ CURLcode Curl_setblobopt(struct curl_blob **blobp, if(blob) { struct curl_blob *nblob; - if(!blob->len || (blob->len > CURL_MAX_INPUT_LENGTH)) + if(!blob->data || !blob->len || (blob->len > CURL_MAX_INPUT_LENGTH)) return CURLE_BAD_FUNCTION_ARGUMENT; nblob = (struct curl_blob *) curlx_malloc(sizeof(struct curl_blob) +