romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 22:23:58 +03:00
Code Issues Projects Releases Packages Wiki Activity

netrc: skip malformed macdef lines

Browse source 
When skipping macdef lines inside netrc files, ignore it completely and
do not tokenize or bail out on bad quotes.

Verify in test 1672

Follow-up to 3b43a05e00

Spotted by Codex Security
Closes #21049
This commit is contained in:
Daniel Stenberg 2026-03-21 15:23:28 +01:00
parent 6026d76fdf
commit fa13f373b2
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 59 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lib/netrc.c
View file

@ -195,6 +195,9 @@ static NETRCcode netrc_get_token(const char **tokp,
if(*statep == MACDEF) {
if((*tok == '\n') || (*tok == '\r'))
*statep = NOTHING; /* end of macro definition */
*lineend = TRUE;
*tokp = tok;
return NETRC_OK;
}
if(!*tok || (*tok == '\n')) {