mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2024-12-15 06:40:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

tool_paramhelp: asserts verify maximum sizes for string loading

Browse Source 
The two defines MAX_FILE2MEMORY and MAX_FILE2STRING define the largest
strings accepted when loading files into memory, but as the size is
later used as input to functions that take the size as 'int' as
argument, the sizes must not be larger than INT_MAX.

These two new assert()s make the code error out if someone would bump
the sizes without this consideration.

Reported-by Trail of Bits

Closes #9719
This commit is contained in:
Daniel Stenberg 2022-10-13 12:00:09 +02:00
parent b46136f9b1
commit eef7ad1573
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/tool_paramhlp.c
View File

@ -68,6 +68,7 @@ struct getout *new_getout(struct OperationConfig *config)
ParameterError file2string(char **bufp, FILE *file)
{
struct curlx_dynbuf dyn;
DEBUGASSERT(MAX_FILE2STRING < INT_MAX); /* needs to fit in an int later */
curlx_dyn_init(&dyn, MAX_FILE2STRING);
if(file) {
char buffer[256];
@ -94,6 +95,8 @@ ParameterError file2memory(char **bufp, size_t *size, FILE *file)
if(file) {
size_t nread;
struct curlx_dynbuf dyn;
/* The size needs to fit in an int later */
DEBUGASSERT(MAX_FILE2MEMORY < INT_MAX);
curlx_dyn_init(&dyn, MAX_FILE2MEMORY);
do {
char buffer[4096];