mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2024-12-09 06:30:06 +08:00
Code Issues Packages Projects Releases Wiki Activity

curl: fix segmentation fault for empty output file names.

Browse Source 
Function glob_match_url set *result to NULL when called with filename =
"", producing an indirect NULL pointer dereference.

Closes #8606
This commit is contained in:
Ian Blanes 2022-03-28 09:39:09 +02:00 committed by Daniel Stenberg
parent a6c3b7d6f5
commit 9e5bd9ba19
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
3 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/tool_getparam.c
View File

@ -2043,6 +2043,10 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */
/* fill in the outfile */
if('o' == letter) {
if(!*nextarg) {
warnf(global, "output file name has no length\n");
return PARAM_BAD_USE;
}
GetStr(&url->outfile, nextarg);
url->flags &= ~GETOUT_USEREMOTE; /* switch off */
}

5
src/tool_operate.c
View File

@ -1020,6 +1020,11 @@ static CURLcode single_transfer(struct GlobalConfig *global,
warnf(global, "bad output glob!\n");
break;
}
if(!*per->outfile) {
warnf(global, "output glob produces empty string!\n");
result = CURLE_WRITE_ERROR;
break;
}
}
if(config->output_dir && *config->output_dir) {

5
src/tool_urlglob.c
View File

@ -5,7 +5,7 @@
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
* Copyright (C) 1998 - 2021, Daniel Stenberg, <daniel@haxx.se>, et al.
* Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
@ -686,6 +686,9 @@ CURLcode glob_match_url(char **result, char *filename, struct URLGlob *glob)
return CURLE_OUT_OF_MEMORY;
}
if(curlx_dyn_addn(&dyn, "", 0))
return CURLE_OUT_OF_MEMORY;
#if defined(MSDOS) || defined(WIN32)
{
char *sanitized;