mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2025-03-01 15:15:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

url: fix buffer overwrite with file protocol (CVE-2017-9502)

Browse Source 
Bug: https://github.com/curl/curl/issues/1540
Advisory: https://curl.haxx.se/docs/adv_20170614.html

Assisted-by: Ray Satiro
Reported-by: Marcel Raad
This commit is contained in:
Daniel Stenberg 2017-06-07 00:21:04 +02:00
parent 5fa028e508
commit 5d7952f52e
1 changed files with 22 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
lib/url.c
View File

@ -4466,6 +4466,7 @@ static CURLcode parseurlandfillconn(struct Curl_easy *data,
#endif #endif
protop = "file"; /* protocol string */ protop = "file"; /* protocol string */
*prot_missing = !url_has_scheme;
} }
else { else {
/* clear path */ /* clear path */
@ -4629,14 +4630,30 @@ static CURLcode parseurlandfillconn(struct Curl_easy *data,
size_t plen = strlen(path); /* new path, should be 1 byte longer than size_t plen = strlen(path); /* new path, should be 1 byte longer than
the original */ the original */
size_t urllen = strlen(data->change.url); /* original URL length */
size_t prefixlen = strlen(conn->host.name); size_t prefixlen = strlen(conn->host.name);
if(!*prot_missing) if(!*prot_missing) {
prefixlen += strlen(protop) + strlen("://"); size_t protolen = strlen(protop);
reurl = malloc(urllen + 2); /* 2 for zerobyte + slash */ if(curl_strnequal(protop, data->change.url, protolen))
prefixlen += protolen;
else {
failf(data, "<url> malformed");
return CURLE_URL_MALFORMAT;
}
if(curl_strnequal("://", &data->change.url[protolen], 3))
prefixlen += 3;
/* only file: is allowed to omit one or both slashes */
else if(curl_strnequal("file:", data->change.url, 5))
prefixlen += 1 + (data->change.url[5] == '/');
else {
failf(data, "<url> malformed");
return CURLE_URL_MALFORMAT;
}
}
reurl = malloc(prefixlen + plen + 1);
if(!reurl) if(!reurl)
return CURLE_OUT_OF_MEMORY; return CURLE_OUT_OF_MEMORY;