mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2025-01-18 14:04:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

tool_writeout: fixed a buffer read overrun on --write-out

Browse Source 
If a % ended the statement, the string's trailing NUL would be skipped
and memory past the end of the buffer would be accessed and potentially
displayed as part of the --write-out output. Added tests 1440 and 1441
to check for this kind of condition.

Reported-by: Brian Carpenter
This commit is contained in:
Dan Fandrich 2017-03-11 10:59:34 +01:00
parent d2bcf1e3e2
commit 1890d59905
4 changed files with 64 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/tool_writeout.c
View File

@ -113,7 +113,7 @@ void ourWriteOut(CURL *curl, struct OutStruct *outs, const char *writeinfo)
double doubleinfo; double doubleinfo;
while(ptr && *ptr) { while(ptr && *ptr) {
if('%' == *ptr) { if('%' == *ptr && ptr[1]) {
if('%' == ptr[1]) { if('%' == ptr[1]) {
/* an escaped %-letter */ /* an escaped %-letter */
fputc('%', stream); fputc('%', stream);

2
tests/data/Makefile.inc
View File

@ -153,7 +153,7 @@ test1408 test1409 test1410 test1411 test1412 test1413 test1414 test1415 \
test1416 test1417 test1418 test1419 test1420 test1421 test1422 test1423 \ test1416 test1417 test1418 test1419 test1420 test1421 test1422 test1423 \
test1424 \ test1424 \
test1428 test1429 test1430 test1431 test1432 test1433 test1434 test1435 \ test1428 test1429 test1430 test1431 test1432 test1433 test1434 test1435 \
test1436 test1437 test1438 test1439 \ test1436 test1437 test1438 test1439 test1440 test1441 \
\ \
test1500 test1501 test1502 test1503 test1504 test1505 test1506 test1507 \ test1500 test1501 test1502 test1503 test1504 test1505 test1506 test1507 \
test1508 test1509 test1510 test1511 test1512 test1513 test1514 test1515 \ test1508 test1509 test1510 test1511 test1512 test1513 test1514 test1515 \

31
tests/data/test1440 Normal file
View File

@ -0,0 +1,31 @@
<testcase>
<info>
<keywords>
--write-out
</keywords>
</info>
# Server-side
<reply>
</reply>
# Client-side
<client>
<server>
file
</server>
<name>
Check --write-out with trailing %{
</name>
<command>
file://localhost/%PWD/log/ --write-out '%{'
</command>
</client>
# Verify data
<verify>
<stdout nonewline="yes">
%{
</stdout>
</verify>
</testcase>

31
tests/data/test1441 Normal file
View File

@ -0,0 +1,31 @@
<testcase>
<info>
<keywords>
--write-out
</keywords>
</info>
# Server-side
<reply>
</reply>
# Client-side
<client>
<server>
file
</server>
<name>
Check --write-out with trailing %
</name>
<command>
file://localhost/%PWD/log/ --write-out '%'
</command>
</client>
# Verify data
<verify>
<stdout nonewline="yes">
%
</stdout>
</verify>
</testcase>