mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2025-04-24 16:40:32 +08:00
Code Issues Packages Projects Releases Wiki Activity

range: prevent negative end number in a glob range

Browse Source 
CVE-2016-8620

Bug: https://curl.haxx.se/docs/adv_20161102F.html
Reported-by: Luật Nguyễn
This commit is contained in:
Daniel Stenberg 2016-10-03 17:27:16 +02:00
parent 96a80b5a26
commit fbb5f1aa03
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/tool_urlglob.c
View File

@ -257,6 +257,12 @@ static CURLcode glob_range(URLGlob *glob, char **patternp,
endp = NULL; endp = NULL;
else { else {
pattern = endp+1; pattern = endp+1;
while(*pattern && ISBLANK(*pattern))
pattern++;
if(!ISDIGIT(*pattern)) {
endp = NULL;
goto fail;
}
errno = 0; errno = 0;
max_n = strtoul(pattern, &endp, 10); max_n = strtoul(pattern, &endp, 10);
if(errno || (*endp == ':')) { if(errno || (*endp == ':')) {
@ -277,6 +283,7 @@ static CURLcode glob_range(URLGlob *glob, char **patternp,
} }
} }
fail:
*posp += (pattern - *patternp); *posp += (pattern - *patternp);
if(!endp || (min_n > max_n) || (step_n > (max_n - min_n)) || !step_n) if(!endp || (min_n > max_n) || (step_n > (max_n - min_n)) || !step_n)