mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2024-12-15 06:40:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

urlglob: fix division by zero

Browse Source 
The multiply() function that is used to avoid integer overflows, was
itself reason for a possible division by zero error when passed a
specially formatted glob.

Reported-by: GwanYeong Kim
This commit is contained in:
Daniel Stenberg 2017-06-10 14:35:07 +02:00
parent f6dff827d3
commit 5fa028e508
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/tool_urlglob.c
View File

@ -5,7 +5,7 @@
* | (__| |_| | _ <| |___ * | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____| * \___|\___/|_| \_\_____|
* *
* Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al. * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
* *
* This software is licensed as described in the file COPYING, which * This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms * you should have received as part of this distribution. The terms
@ -66,6 +66,10 @@ static CURLcode glob_fixed(URLGlob *glob, char *fixed, size_t len)
static int multiply(unsigned long *amount, long with) static int multiply(unsigned long *amount, long with)
{ {
unsigned long sum = *amount * with; unsigned long sum = *amount * with;
if(!with) {
*amount = 0;
return 0;
}
if(sum/with != *amount) if(sum/with != *amount)
return 1; /* didn't fit, bail out */ return 1; /* didn't fit, bail out */
*amount = sum; *amount = sum;