From 5fa028e508056e3569beb5698e3f52e45fea94da Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Sat, 10 Jun 2017 14:35:07 +0200 Subject: [PATCH] urlglob: fix division by zero The multiply() function that is used to avoid integer overflows, was itself reason for a possible division by zero error when passed a specially formatted glob. Reported-by: GwanYeong Kim --- src/tool_urlglob.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/tool_urlglob.c b/src/tool_urlglob.c index d002f276d3..6b1ece008b 100644 --- a/src/tool_urlglob.c +++ b/src/tool_urlglob.c @@ -5,7 +5,7 @@ * | (__| |_| | _ <| |___ * \___|\___/|_| \_\_____| * - * Copyright (C) 1998 - 2016, Daniel Stenberg, , et al. + * Copyright (C) 1998 - 2017, Daniel Stenberg, , et al. * * This software is licensed as described in the file COPYING, which * you should have received as part of this distribution. The terms @@ -66,6 +66,10 @@ static CURLcode glob_fixed(URLGlob *glob, char *fixed, size_t len) static int multiply(unsigned long *amount, long with) { unsigned long sum = *amount * with; + if(!with) { + *amount = 0; + return 0; + } if(sum/with != *amount) return 1; /* didn't fit, bail out */ *amount = sum;