moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2025-01-10 21:48:10 -05:00
Code Issues Releases Wiki Activity

Curl_dedotdotify(): always nul terminate returned string.

Browse Source 
This fixes potential out-of-buffer access on "file:./" URL

$ valgrind curl "file:./"
==24516== Memcheck, a memory error detector
==24516== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==24516== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==24516== Command: /home/even/install-curl-git/bin/curl file:./
==24516==
==24516== Conditional jump or move depends on uninitialised value(s)
==24516==    at 0x4C31F9C: strcmp (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==24516==    by 0x4EBB315: seturl (urlapi.c:801)
==24516==    by 0x4EBB568: parseurl (urlapi.c:861)
==24516==    by 0x4EBC509: curl_url_set (urlapi.c:1199)
==24516==    by 0x4E644C6: parseurlandfillconn (url.c:2044)
==24516==    by 0x4E67AEF: create_conn (url.c:3613)
==24516==    by 0x4E68A4F: Curl_connect (url.c:4119)
==24516==    by 0x4E7F0A4: multi_runsingle (multi.c:1440)
==24516==    by 0x4E808E5: curl_multi_perform (multi.c:2173)
==24516==    by 0x4E7558C: easy_transfer (easy.c:686)
==24516==    by 0x4E75801: easy_perform (easy.c:779)
==24516==    by 0x4E75868: curl_easy_perform (easy.c:798)

Was originally spotted by
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10637
Credit to OSS-Fuzz

Closes #3039
This commit is contained in:
Even Rouault 2018-09-23 14:17:30 +02:00 committed by Daniel Stenberg
parent 6ae6b2a533
commit 55b51b8c49
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
2 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/dotdot.c
View File

@ -62,6 +62,8 @@ char *Curl_dedotdotify(const char *input)
if(!out) if(!out)
return NULL; /* out of memory */ return NULL; /* out of memory */
*out = 0; /* zero terminates, for inputs like "./" */
/* get a cloned copy of the input */ /* get a cloned copy of the input */
clone = strdup(input); clone = strdup(input);
if(!clone) { if(!clone) {

3
tests/libtest/lib1560.c
View File

@ -300,6 +300,9 @@ static struct urltestcase get_url_list[] = {
{"file:///file.txt", {"file:///file.txt",
"file:///file.txt", "file:///file.txt",
0, 0, CURLUE_OK}, 0, 0, CURLUE_OK},
{"file:./",
"file://",
0, 0, CURLUE_MALFORMED_INPUT},
{"http://example.com/hello/../here", {"http://example.com/hello/../here",
"http://example.com/hello/../here", "http://example.com/hello/../here",
CURLU_PATH_AS_IS, 0, CURLUE_OK}, CURLU_PATH_AS_IS, 0, CURLUE_OK},